Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Exploit module for CVE-2023-40044 (WS_FTP unauthenticated RCE) #18414

Merged
merged 6 commits into from
Oct 4, 2023
Merged

Exploit module for CVE-2023-40044 (WS_FTP unauthenticated RCE) #18414

merged 6 commits into from
Oct 4, 2023

Commits on Oct 2, 2023

  1. add in exploit module for CVE-2023-40044 - WS_FTP unauthenticated RCE… 

    … via .NET deserialization.
    @sfewer-r7
    sfewer-r7 committed Oct 2, 2023
    Configuration menu
    Copy the full SHA
    53ed4a6 View commit details
    Browse the repository at this point in the history

  2. Explicitly state both the release name (e.g. 2022.0.2) and the versio… 

    …n number (e.g. 8.8.2) in a more consistent way.
    @sfewer-r7
    sfewer-r7 committed Oct 2, 2023
    Configuration menu
    Copy the full SHA
    1695a12 View commit details
    Browse the repository at this point in the history

Commits on Oct 3, 2023

  1. Add a reference to the AssetNote blog. Better describe what teh TARGE… 

    …T_URI option is for and why it defaults to /AHT/
    @sfewer-r7
    sfewer-r7 committed Oct 3, 2023
    Configuration menu
    Copy the full SHA
    2eacb75 View commit details
    Browse the repository at this point in the history

  2. remove the powershell target as the powershell command adapter will h… 

    …andle this for us (thanks Spencer). Increate the space to handle the larger powershell command lines. I tested with cmd/windows/powershell/x64/meterpreter/reverse_tcp and the powershell command length was 4404.
    @sfewer-r7
    sfewer-r7 committed Oct 3, 2023
    Configuration menu
    Copy the full SHA
    1be8e02 View commit details
    Browse the repository at this point in the history

Commits on Oct 4, 2023

  1. change the payload space to 5000. This allows all the payloads I test… 

    …ed to work but also allows all the 3 gadget chains I tested to work. ClaimsPrincipal and TypeConfuseDelegate will fail if the space is too large.
    @sfewer-r7
    sfewer-r7 committed Oct 4, 2023
    Configuration menu
    Copy the full SHA
    ccd8c71 View commit details
    Browse the repository at this point in the history

  2. leverage Rex::MIME::Message instead of creating the multipart data ma… 

    …nualy
    @sfewer-r7
    sfewer-r7 committed Oct 4, 2023
    Configuration menu
    Copy the full SHA
    8431d11 View commit details
    Browse the repository at this point in the history