Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merge upstream #1

Merged
merged 5,228 commits into from
Jun 5, 2020
Merged

Merge upstream #1

merged 5,228 commits into from
Jun 5, 2020

Conversation

rrockru
Copy link
Owner

@rrockru rrockru commented Jun 5, 2020

Tell us what this change does. If you're fixing a bug, please mention
the github issue number.

Please ensure you are submitting from a unique branch in your repository to master in Rapid7's.

Verification

List the steps needed to make sure this thing works

  • Start msfconsole
  • use exploit/windows/smb/ms08_067_netapi
  • ...
  • Verify the thing does what it should
  • Verify the thing does not do what it should not
  • Document the thing and how it works (Example)

bwatters-r7 and others added 30 commits May 8, 2020 13:23
@bwatters-r7
Land #13358, Fix packet ordering check
6fae8f0 
Merge branch 'land-13358' into upstream-master
@smcintyre-r7
Clanup cloud_lookup docs and remove some unnecessary code
e243d3e
@bwatters-r7
Use new method
1a9c04c
@smcintyre-r7
Land #12234, Add a module to identify web servers behind cloud based …
8ccb93e 
…protections
@msjenkins-r7
automatic module_metadata_base.json update
bc15315
@bcoles
Merge pull request #8 from bwatters-r7/land-13402
c49b189 
Use new method
@bcoles
Update CVE-2019-13272 exploit C code to prefer auto targeting
dbc2b8b 
Previously, the exploit would attempt to use a hardcoded list of
known useful helpers and fall back to automatic targeting. This
logic has been reversed, preferring automatic targeting first.
Merge pull request #17 from rapid7/master
8778ddd 
sasas
Update advisory link in doc
bba9d0a
Fix advisory link in TM1 module
cf25629
Fix advisory link in Qradar sploit
d31ddad
@wvu
Refactor Msf::Exploit::CmdStager::HTTP
1214ac1 
Minor updates to align with current style.
@wvu
Land #13426, Msf::Exploit::CmdStager::HTTP fixes
1171cfa
@wvu
Land #13423, advisory fixes for pedrib IBM modules
32ed4bc
@msjenkins-r7
automatic module_metadata_base.json update
51f00e4
@adfoster-r7
Update msf json rpc file path to be relative
e814007
@busterb
Land #13433, Update MSF JSON-RPC framework path to be relative
6a629d4
@bcoles
Update CVE-2019-13272 pre-compiled exploit
8631bab
@wvu
Add SaltStack Salt root key disclosure module
f346b1b 
Also adds a new ZeroMQ mixin, mainly for use with Salt modules.
@wvu
Disable RuboCop Security/Eval the non-hacky way
646c10f 
Hat tip @adfoster-r7!
@wvu
Add SaltStack Salt unauthenticated RCE module
6e8abd7
@wvu
Add VMware vRealize Operations Manager advisory
83dde57 
Hat tip @brudis-r7!
@wvu
Add module docs
f85a8c2
@wvu
Note what CheckModule is used to provide a check
06cae74 
Hat tip @ccondon-r7 for making me realize my standard comment needs to
be reapplied.
@space-r7
add t3_send comment and cmdstager code
5e0469c
@cnotin
Fix regression in psexec mixing filename and encoder
b7d16b1 
Closes #13407
@cnotin
Use print_error for error messages
258895f
@wvu
Add Netsweeper WebAdmin unixlogin.php pre-auth RCE
235f822
@bcoles
Land #13422, CVE-2019-13272 prefer automatic targeting over hard-code…
3769c5f 
…d helpers

Previously, the exploit would attempt to use a hardcoded list of
known useful helpers and fall back to automatic targeting. This
logic has been reversed, preferring automatic targeting first.
@bwatters-r7
Land #13429, Add Netsweeper WebAdmin unixlogin.php pre-auth RCE
6d95211 
Merge branch 'land-13429' into upstream-master
space-r7 and others added 29 commits June 2, 2020 14:24
@space-r7
add documentation
d0afec2
@space-r7
add poc code
c8ab30a
@h00die
docs
ff06708
@bwatters-r7
Land #13541, Add controls to screen capture module
7dc2bc7 
Merge branch 'land-13541' into upstream-master
@msjenkins-r7
automatic module_metadata_base.json update
59aac86
@Zenofex
A user reported that the CVE-2020-12720 modules were not properly han…
8f587e4 
…dling cases where a table prefix was not used, this guard clauses was redundant in that the one inside the get_table_prefix method is already checking the result of the SQL injection performed.
@wvu
Add Cisco UCS Director Cloupia script RCE
32ae47c
@wvu
Base64-encode command payload to avoid escaping
4a9c298
@wvu
Document directory traversals
64de8c4
@h00die
more fixes
a2e385e
@h00die
rubocop
434a1f5
@bwatters-r7
Land #13486, fix #13486, add support for python and cmd targets in os…
26ff9b5 
…x/local/persistence

Merge branch 'land-13497' into upstream-master
@msjenkins-r7
automatic module_metadata_base.json update
28e3da0
@wvu
Land #13553, vbulletin_getindexablecontent* fixes
464c157
@msjenkins-r7
automatic module_metadata_base.json update
45fd758
@wvu
Land #13552, WebLogic CVE-2020-2883 exploit
8ad7b71
@msjenkins-r7
automatic module_metadata_base.json update
81bd1d8
@h00die
more error handling
0df1a2a
@dwelch-r7
Land #13540, Replace OptString with OptPort for RPORT
b0bec9c
@msjenkins-r7
automatic module_metadata_base.json update
42b7c80
@acammack-r7
Land #13448, Fix relative location redirects
0019104
@space-r7
add session_created, fix typo
329ba10
@space-r7
Land #13545, add drag / drop file upload rce
51fca24
@msjenkins-r7
automatic module_metadata_base.json update
f8a738c
@msjenkins-r7
Bump version of framework to 5.0.93
3864995
@zeroSteiner
Restrict the ruby_smb gem version until v2.0 has been tested more
8bfe711
@jmartin-tech
Land #13558, Restrict the ruby_smb gem version
cee82d8
@bwatters-r7
Land #13384, Add Cisco UCS Director auth bypass, directory traversal(s),
5932e75 
and Cloupia script RCE (CVE-2020-3243 / ZDI-20-540)

Merge branch 'land-13384' into upstream-master
@msjenkins-r7
automatic module_metadata_base.json update
a5dc25a
@rrockru rrockru merged commit a86403c into rrockru:master Jun 5, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone