Post Syndicated from Brendan Watters original https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen

This One Goes to Sixteen!

Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers!

New module content (16)

Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read

Authors: Bourbon Offensive Security Services and Jean-Marie Bourbon

Type: Auxiliary

Pull request: #21739 contributed by kmkz

Path: scanner/http/elasticsearch_tika_xfa_xxe

CVE reference: CVE-2025-66516

Description: Adds an auxiliary scanner module for CVE-2025-54988/CVE-2025-66516. The module validates an XML External Entity (XXE) vulnerability in Apache Tika’s XFA parser exposed through the Elasticsearch attachment ingest processor.

SPIP Unauthenticated Blind SQLi via Date Field Escaping Bypass

Authors: Benoit Hua, Franck Chevalier, Julien Voisin, and ka3n1x

Type: Auxiliary

Pull request: #21791 contributed by jvoisin

Path: scanner/http/spip_annee_sqli

Description: Adds modules/auxiliary/scanner/http/spip_annee_sqli.rb which exploits a blind SQL injection in SPIP’s date column escaping logic.

Metasploit Payload Handler Detection (TCP/UDP/HTTP/HTTPS)

Author: h00die

Type: Auxiliary

Pull request: #21551 contributed by h00die

Path: scanner/msf/handler_detect

Description: Adds a scanner module to enumerate ports on a host and determine if they’re a Metasploit Reverse Handler or not, and if they are, what kind of shell they were going to land.

ESC8 Relay: SMB to HTTP(S) via Kerberos

Author: Pushpender Rathore

Type: Auxiliary

Pull request: #21709 contributed by Pushpenderrathore

Path: server/relay/esc8_kerberos

CVE reference: CVE-2026-20929

Description: This introduces native Kerberos authentication relay capabilities to the framework’s relay stack. It includes a new auxiliary module (esc8_kerberos) that exploits CVE-2026-20929 by targeting AD CS Web Enrollment (ESC8). The module captures an SMB2 AP-REQ from a coerced client and seamlessly replays the authentication to the target certificate server over HTTP. This chain ultimately allows an attacker to issue a certificate for the coerced victim and obtain a valid Kerberos TGT without requiring their credentials.

Linux x64 Sandbox Environment Gate

Author: Massimo Bertocchi

Type: Evasion

Pull request: #21642 contributed by litemars

Path: linux/x64/sandbox_gate

Description: Adds a Linux x64 sandbox‑evasion module that performs lightweight runtime environment checks and aborts execution when a likely sandbox or VM is detected.

Cisco Secure Firewall Management Center Authentication Bypass RCE

Authors: Arian Eidizadeh, Brandon Sakai, and Cale Black

Type: Exploit

Pull request: #21796 contributed by CyberAuth

Path: linux/http/cisco_fmc_auth_bypass_rce

CVE reference: CVE-2026-20079

Description: Adds a native Metasploit exploit module for CVE-2026-20079, an unauthenticated authentication bypass in Cisco Secure Firewall Management Center (FMC).

SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution

Authors: Adam Babis, William Perry, and sfewer-r7

Type: Exploit

Pull request: #21883 contributed by sfewer-r7

Path: linux/http/sonicwall_sma1000_couchdb_rce

CVE reference: CVE-2026-83549

Description: This adds an exploit module for the recent SonicWall SMA1000 zero-day exploit chain that was disclosed in the first week of September as being exploited in-the-wild. CVE-2026-83548 is an SSRF used to bypass auth. SMA1000-9427 is an RCE with low privileges via CouchDB read/write primitives. CVE-2026-83549 is a command injection in cmsSnmpTrap.sh for RCE with root privs. The patched version 12.5.0-02952 has been verified to successfully remediate this exploit chain.

JetBrains TeamCity Agent Polling Unauthenticated Remote Code Execution

Authors: Antoni Tremblay and sfewer-r7

Type: Exploit

Pull request: #21775 contributed by sfewer-r7

Path: multi/http/jetbrains_teamcity_rce_cve_2026_63077

CVE reference: CVE-2026-63077

Description: This introduces a new unauthenticated Remote Code Execution (RCE) exploit module for JetBrains TeamCity, targeting the vulnerability tracked as CVE-2026-63077. The module exploits an unsafe XStream deserialization flaw within the agent polling protocol to deliver and execute a one-shot JSP payload on the server. The module supports both Windows and Linux targets and features built-in cleanup logic to automatically unregister and remove the fake build agent created during the exploitation process.

Langflow AI authenticated RCE

Author: Richard Howe

Type: Exploit

Pull request: #21837 contributed by rmhowe425

Path: multi/http/langflow_auth_rce_cve_2026_19295

CVE reference: CVE-2026-19295

Description: Adds a new module targeting CVE-2026-19295, an authenticated remote code execution vulnerability impacting Langflow versions 1.10.0 and below.

MCPJam Inspector Connect API Command Execution

Authors: Louay-075 and earthenvessel

Type: Exploit

Pull request: #21655 contributed by earthenvessel

Path: multi/http/mcpjam_inspector_rce

CVE reference: CVE-2026-23744

Description: This adds a new exploit module for CVE-2026-23744, an unauthenticated command execution vulnerability in MCPJam Inspector. The module targets the /api/mcp/connect endpoint. Vulnerable versions accept a JSON serverConfig object containing a command and args array, then use those values to start an MCP server. When MCPJam Inspector is exposed on a routable interface, an unauthenticated remote attacker can abuse this behavior to execute operating system commands as the user running MCPJam Inspector.

PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)

Author: sfewer-r7

Type: Exploit

Pull request: #21842 contributed by sfewer-r7

Path: multi/http/papercut_ng_external_user_lookup_rce

CVE reference: CVE-2026-82078

Description: Adds an exploit module for the recent PaperCut MF and PaperCut NG exploit chain (CVE-2026-81578 + CVE-2026-82078) that was reported last week as a zero-day being actively exploited in the wild.

SimpleHelp OIDC Authentication Bypass Remote Code Execution

Authors: Blackpoint Cyber, Horizon3.ai, Zach Hanley, and jheysel-r7

Type: Exploit

Pull request: #21825 contributed by jheysel-r7

Path: multi/http/simplehelp_oidc_auth_bypass_rce

CVE reference: CVE-2026-48558

Description: Adds an exploit module for CVE-2026-48558, an OIDC authentication bypass affecting SimpleHelp 5.5.0 through 5.5.15.

SPIP Autosave Session Unauthenticated RCE

Author: Julien Voisin

Type: Exploit

Pull request: #21859 contributed by jvoisin

Path: multi/http/spip_autosave_rce

Description: Adds a module targeting an unauthenticated remote code execution vulnerability in SPIP <= 4.4.21 via the forum autosave session handler. The action=session endpoint lets any visitor store arbitrary PHP code in a session variable, which is then executed by the template engine when the article page is rendered. No CVE has yet been issued.

Next.js Unauthenticated RCE on Windows Servers

Authors: Avishek Sarkar, Bogyeom Lee, and Maksim Rogov

Type: Exploit

Pull request: #21834 contributed by vognik

Path: windows/http/nextjs_unauth_rce_cve_2026_75604

CVE reference: CVE-2026-75604

Description: Adds a module targeting CVE-2026-75604, a Remote Code Execution (RCE) vulnerability in Next.js applications hosted on Windows servers. Specifically crafted requests can execute arbitrary code on the target server running Next.js versions from 13.4.0 up to 15.5.24, and 16.0.0 up to 16.3.3.

Boot Verification Program Persistence

Author: Emanuele Cervelli

Type: Exploit

Pull request: #21550 contributed by M4nu02

Path: windows/persistence/boot_verification_program

Description: Adds a Windows persistence module leveraging the registry key BootVerificationProgram.

Windows Time Provider Persistence

Author: Emanuele Cervelli

Type: Exploit

Pull request: #21522 contributed by M4nu02

Path: windows/persistence/time_provider

Description: Adds a new persistence module that registers a custom Time Provider DLL under the W32Time service registry key.

Bugs fixed (4)

• #21719 from Pushpenderrathore – Fixes a race condition in the module Metadata cache.
• #21838 from jheysel-r7 – Fixes payload choosing behaviour when swapping targets to auto-select the most fitting payload which can now also include Java payloads.
• #21853 from Pushpenderrathore – Three fixes to the core Rex::Proto::DNS forward/cache path that surface once the DNS server is used as a selective poisoner in front of a real upstream resolver
• #21861 from prithvee07 – Fixes a recent regression in the vsftpd_234_backdoor module where by updating the module to support ARCH_CMD payloads we inadvertently dropped support for cmd/unix/interact payloads. Both payloads are now supported.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.5.3…6.5.4
• Full diff 6.5.3…6.5.4

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro.

Post Syndicated from Brendan Watters original https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-05-06-2026

When Open Source is a bit too Open

Several fun modules landed this week, including an Apache RCE, Windows Kernel pointer collection, and Gogs RCE via naming. Leading off is Gogs’ RCE that allows an attacker to execute commands by naming their branch –exec <command> and requesting a rebase.

Another useful post module by CharlesQuinnDev enumerates the Kernel pointers leaked via the popular NtQuerySystemInformation technique. Those exposed pointers, combined with a good write primitive, make local privilege escalation easier to accomplish. Several local privilege escalations already use that technique, so exposing just that technique was a great call!

New module content (3)

Apache ActiveMQ RCE via Jolokia addNetworkConnector

Authors: dinosn and h00die
Type: Exploit
Pull request: #21497 contributed by h00die
Path: multi/http/apache_activemq_jolokia_rce
AttackerKB reference: CVE-2026-34197

Adds a new exploit module exploit/multi/http/apache_activemq_jolokia_rce targeting CVE-2026-34197 in Apache ActiveMQ. The module abuses the Jolokia JMX-over-HTTP API exposed at /api/jolokia/ by calling the addNetworkConnector() MBean operation with a crafted brokerConfig=xbean:http://… URI. ActiveMQ fetches the attacker-controlled URL and instantiates it as a Spring XML application context, achieving remote code execution via a java.lang.ProcessBuilder bean. Authentication is required to exploit this vulnerability.

Gogs Git Rebase Argument Injection RCE

Author: Crypto-Cat
Type: Exploit
Pull request: #21515 contributed by jburgess-r7
Path: multi/http/gogs_rebase_rce

This adds an exploit module for the Gogs rebase Remote Code Execution (RCE) vulnerability. The module leverages an argument injection flaw residing in the pull request merge workflow of Gogs versions <= 0.14.2 and <= 0.15.0+dev.

Windows Kernel Pointer Exposure Enumerator

Author: CharlesQuinnDev
Type: Post
Pull request: #21039 contributed by CharlesQuinnDev
Path: windows/gather/windows_kernel_pointer_enum

Adds a new post module for Windows that enumerates kernel object pointers exposed through NtQuerySystemInformation on x64 systems. The module collects observable handle metadata and provides analysis of pointer distribution, object types, and ALPC usage, then saves the results to a CSV loot file for review. Also introduces a reusable Windows kernel handle-enumeration library.

Enhancements and features (7)

• #20881 from h00die – This adds support for cracking Kerberos type hashes in Metasploit, specifically timeroasting, krb5tgs* and krb5asrep.
• #21087 from jbx81-1337 – The new payloads_manager plugin lets you maintain a local archive of custom payloads and stage them into the data directory. Use the fetch or add subcommands to download or import a payload, then select to symlink it into place so it’s available to other modules. The plugin tracks each payload’s name, hash, tags, and description in a database.
• #21412 from zeroSteiner – Updates Metasploit’s post modules to now run by default against the last opened alive session, unless explicitly specified.
• #21429 from zeroSteiner – Removes the now redundant Linux-specific method for finding the arch so there’s a single source of truth that works in a superset of platform / session-type combinations.
• #21488 from sjanusz-r7 – Updates HTTP login scanners to report the detected service hierarchy.
• #21504 from h00die – Adds missing CVE references to seven existing modules: gladinet_storage_access_ticket_forge (CVE-2025-14611), cassandra_web_file_read (CVE-2020-36939), pretalx_file_read_cve_2023_28459 (CVE-2023-28459 and CVE-2023-28458), centreon_pollers_auth_rce (CVE-2019-19699), wp_responsive_thumbnail_slider_upload (CVE-2015-10144), xerte_unauthenticated_template_import_rce (CVE-2026-32985), and solarwinds_storage_manager_sql (CVE-2012-2576).
• #21526 from zeroSteiner – Makes stability and logging improvements to the ipmi_cipher_zero, ipmi_dumphashes, and ipmi_version modules.

Bugs fixed (7)

• #21432 from 4ravind-b – Fixes a bug in modules that invoke other modules that prevented datastore options from being validated.
• #21448 from kx7m2qd – Fixes an issue where CIDR range filters in the addresses parameter of the db.hosts RPC endpoint were not processed correctly.
• #21484 from zeroSteiner – Fixes python ssl command shell payloads that failed with AttributeError: module ‘ssl’ has no attribute ‘wrap_socket’.
• #21489 from h00die – Improves the GitLab version scanner by handling additional exceptions in the scanner for non-GitLab targets and adding additional version fingerprints for real GitLab targets.
• #21502 from h00die – Fixes a crash in the scanner/snmp/snmp_enum module when the system date was read as Null.
• #21506 from h00die – Adds a guard clause when running uname -r in WSL startup_folder persistence.
• #21514 from orbit-bot – Fixes a couple of references to outdated msfvenom options.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.4.135…6.4.136
• Full diff 6.4.135…6.4.136

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro.

Post Syndicated from Brendan Watters original https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-03-20-2026

♫ I Just Called ♫ To Say ♫ 7f45 4c46 0201 0100 0000 0000 0000 0000 0300 3e00 0100♫

This release contains 2 new exploit modules, 2 enhancements, and 7 bug fixes. Community contributor Chocapikk submitted both exploit modules this release: one targeting AVideo-Encoder’s getImage.php file and another targeting FreePBX. Leading the enhancements is a granularization for LDAP queries allowing the omission of SACL data on security descriptors, as without the proper permissions the entire query of the security descriptor will fail if the SACL data is even just a part of the query.

New module content (2)

AVideo Encoder getImage.php Unauthenticated Command Injection

Authors: Valentin Lobstein [email protected] and arkmarta

Type: Exploit

Pull request: #21076 contributed by Chocapikk

Path: linux/http/avideo_encoder_getimage_cmd_injection

AttackerKB reference: CVE-2026-29058

Description: Adds an exploit module for CVE-2026-29058, an unauthenticated OS command injection in AVideo Encoder’s getImage.php endpoint.

FreePBX filestore authenticated command injection

Authors: Cory Billington and Valentin Lobstein [email protected]

Type: Exploit

Pull request: #20719 contributed by Chocapikk

Path: unix/http/freepbx_filestore_cmd_injection

AttackerKB reference: CVE-2025-64328

Description: Adds a new Metasploit exploit module for FreePBX filestore authenticated command injection (CVE-2025-64328) with automatic vulnerable-version detection and full documentation, and renames the XorcomCompletePbx HTTP mixin to CompletePBX updating affected modules accordingly.

Enhancements and features (2)

• #20730 from zeroSteiner – This update modifies the ldap_query module to skip querying the SACL (System Access Control List) on security descriptors by default. This behavior is now controlled by a new option, LDAP::QuerySacl. This change is necessary when using a non-privileged user to query security descriptors via LDAP; otherwise, querying the SACL will cause the entire query to be blocked, resulting in no security descriptors being returned.
• #20997 from Nayeraneru – This adds a new OptTimedelta datastore option type. It enables module authors to specify a time duration and users to set it with a human-friendly syntax.

Bugs fixed (7)

• #20960 from g0tmi1k – This adds a DHCPINTERFACE option to the DHCP server mixin, allowing modules that start that server to specify a particular interface to bind to.
• #21020 from g0tmi1k – This makes a small change to the docs by removing two lines that were previously duplicated.
• #21024 from Aaditya1273 – Fixes a bug in the JSON-RPC msfrpcd functionality that incorrectly required SSL certificates to be present even when disabled with msfrpcd -S.
• #21025 from Hemang360 – Fixes a crash when calling the HTTP cookie jar with non-string values.
• #21028 from SilentSobs – Fixes a crash when using the reload_all command no module is present.
• #21081 from Hemang360 – Fixes a crash when using the windows/exec with non-ascii characters.
• #21139 from jheysel-r7 – This fixes a bug in the ldap_esc_vulnerable_cert_finder module that was preventing authentication from working when making a WinRM connection.

Documentation added (1)

• #21074 from jeanmtr – Adds documentation for the pop3_login module.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.4.122…6.4.123
• Full diff 6.4.122…6.4.123

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro

Post Syndicated from Brendan Watters original https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-11-14-2025

It has “SUS” in the name, what did you expect?

This week’s release features the much-hyped CVE-2025-59287, a Critical-Severity Windows Server Update Service (WSUS) vulnerability that allows for SYSTEM level remote code execution. Documented among the multiple recent zero-days in Windows, the vulnerability affects Windows Servers running the WSUS service, which is not enabled by default. Several vendors, including Huntress and Eye Security have reported seeing the exploit used in the wild, and the Cybersecurity and Infrastructure Security Agency (CISA) ordered US government agencies to patch affected machines last month.

New module content (1)

Windows Server Update Service Deserialization Remote Code Execution

Authors: msutovsky-r7 and mwulftange

Type: Exploit

Pull request: #20674 contributed by msutovsky-r7 

Path: windows/http/wsus_deserialization_rce 

AttackerKB reference: CVE-2025-59287

Description: Adds a module targeting CVE-2025-59287, an unauthenticated deserialization vulnerability in the Windows Server Update Service (WSUS) resulting in remote code execution as SYSTEM

Enhancements and features (3)

• #20576 from msutovsky-r7 – This updates the LINQPad persistence module to use the new persistence mixin.
• #20669 from stfnw – This updates the auxiliary/scanner/http/azure_ad_login module to print the domain and username in error messages. This enables users to understand what user caused the error.
• #20690 from dbono-r7 – This adds the cert pipe to the list of known pipes that will be checked by the auxiliary/scanner/smb/pipe_auditor module. This effectively enables users to identify when the MS-ICPR interface is available because Active Directory Certificate Services (AD CS) is in use.

Documentation (1)

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

• #20625 from h00die – Improved multiple modules’ documentation to have consistent formatting.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.4.97…6.4.98
• Full diff 6.4.97…6.4.98

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2025/05/09/metasploit-wrap-up-05-09-2025/

New Toys and New Techniques

This release features a new OPNSense login scanner, a module targeting the Sante PACS path traversal vulnerability, an additional method for stealing Network Access Account credentials via SMB to HTTP relay, and the Erlang/OTP SSH exploit everyone was excited about.

New module content (4)

Sante PACS Server Path Traversal (CVE-2025-2264)

Authors: Michael Heinzl and Tenable
Type: Auxiliary
Pull request: #20124 contributed by h4x-x0r
Path: gather/pacsserver_traversal
AttackerKB reference: CVE-2025-2264

Description: This adds an auxiliary module for CVE-2025-2264. The vulnerability is present in Sante PACS Server and allows an attacker to perform path traversal to read arbitrary files.

OPNSense Login Scanner

Author: sjanusz-r7
Type: Auxiliary
Pull request: #19992 contributed by sjanusz-r7
Path: scanner/http/opnsense_login

Description: This adds a login scanner module for OPNSense.

SMB to HTTP relay version of Get NAA Creds

Authors: jheysel-r7, skelsec, smashery, and xpn
Type: Auxiliary
Pull request: #19952 contributed by jheysel-r7
Path: server/relay/relay_get_naa_credentials

Description: This adds a new module for obtaining NAA credentials from SCCM by authenticating through a relayed SMB connection.

Erlang OTP Pre-Auth RCE Scanner and Exploit

Authors: Horizon3 Attack Team, Martin Kristiansen, Matt Keeley, and mekhalleh (RAMELLA Sebastien)
Type: Exploit
Pull request: #20060 contributed by mekhalleh
Path: linux/ssh/ssh_erlangotp_rce
AttackerKB reference: CVE-2025-32433

Description: This adds a module which exploits CVE-2025-32433, a pre-authentication vulnerability in Erlang-based SSH servers
that allows for remote command execution as the root user. By sending crafted SSH packets, it executes a Metasploit payload to establish a session on the target system.

Enhancements and features (4)

• #20027 from e2002e – This adds support for Shodan facets.
• #20115 from cgranleese-r7 – Updates multiple HTTPS modules to support a new SSLKeyLogFile option, which facilitates decrypting messages exchanged by TLS. This can be used in diagnostic and logging tools that use this file – such as Wireshark.
• #20116 from bcoles – This adds support for .library-ms files in Windows SMB multi dropper.
• #20127 from bcoles – This improves the start up time of msfconsole when run with the default options by not sorting module options at load time.

Bugs fixed (1)

• #20148 from adfoster-r7 – This fixes an issue where SSL connections made by Metasploit would fail when the Server Name Indicator (SNI) extension was in use.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2025/03/06/metasploit-wrap-up-03-06-2025/

New module content (3)

Get NAA Credentials

Authors: skelsec, smashery, and xpn
Type: Auxiliary
Pull request: #19712 contributed by smashery
Path: admin/sccm/get_naa_credentials

Description: Adds an auxiliary module which performs the retrieval of Network Access Account (NAA) credentials from an System Center Configuration Manager (SCCM) server. Given a computer name and password (which can typically be created by a standard AD domain user), a misconfigured SCCM server will give NAA credentials when requested.

SonicWall HTTP Login Scanner

Author: msutovsky-r7
Type: Auxiliary
Pull request: #19935 contributed by msutovsky-r7
Path: scanner/sonicwall/login_scanner

Description: This adds a module to brute-force the login credentials for SonicWall NSv HTTP Login.

D-Tale RCE

Authors: Takahiro Yokoyama and taiphung217
Type: Exploit
Pull request: #19899 contributed by Takahiro-Yoko
Path: linux/http/dtale_rce_cve_2025_0655
AttackerKB reference: CVE-2025-0655

Description: This module exploits a bypass (CVE-2025-0655) for an older vulnerability (CVE-2024-3408), leading to remote code execution (RCE) in D-Tale, a visualizer for pandas data structures.

Enhancements and features (7)

• #19639 from zeroSteiner – Adds support for check method in relay modules and updates the two relay modules present in Metasploit Framework. In the case of smb_relay, this checks if the target has SMB signing disabled. In the case of ESC8, it checks that the target URI responds with a 401 and offers NTLM as an authentication mechanism.
• #19682 from h00die – Adds additional tests for Linux post functionality along with additional comments for better understanding; adds new library for work with Linux packages.
• #19879 from zeroSteiner – This updates the existing MsDtypSecurityDescriptor class to include a #to_sddl_text method. This allows an initialized object to be displayed using the Security Descriptor Definition Language defined by Microsoft.
  • #19917 from zeroSteiner – This adds crypto primitives for AES key derivation (NIST SP 800 108) and AES key unwrapping (NIST SP 800 38f) replacing RubySMB’s implementation which does not support all of the parameters.
  • #19918 from msutovsky-r7 – Extracts a reusable Rex::Proto::Http::AuthDigest library for use within modules.
  • #19927 from bcoles – This improves the support of several Linux distros on the library function get_sysinfo in Msf::Post:Linux::System.
  • #19933 from zeroSteiner – Updates the auxiliary/scanner/ldap/ldap_login module with a new CreateSession option which controls the opening of an interactive LDAP session. This functionality was previously behind a feature flag, but is now enabled by default.
  • #19946 from zeroSteiner – Adds a warning to help users that are performing relay attacks. It notes that the attack won’t work when relaying SMB to SMB on the same host if the MS08-068 patch has been applied.

Bugs fixed (5)

• #19745 from smashery – This adds an escape_args method to all command shells that finds the appropriate OS escaping routines for an SSH server.
• #19902 from zeroSteiner – This fixes the byte to int and vice versa conversion in MsAdts.
• #19919 from jheysel-r7 – This fixes an issue in the gather/ldap_esc_vulnerable_cert_finder that would come up when checking templates for ESC13 that had missing issuance policy OIDs.
• #19922 from cgranleese-r7 – Fixes a crash when searching by target, i.e search targets:python.
• #19925 from zeroSteiner – Fixes a bug that caused a module’s validation logic to not always be executed.

Documentation added (2)

• #19895 from cgranleese-r7 – Updates multiple out of date reference links within modules.
• #19920 from jheysel-r7 – This adds documentation for creating AD CS certificate templates that are vulnerable to ESC4, ESC13, and ESC15 for testing purposes.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.4.51…6.4.52
• Full diff 6.4.51…6.4.52

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
commercial edition Metasploit Pro

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2025/01/17/metasploit-wrap-up-01-17-2025/

Clarity in Cleo Exploitation

Last Month, Huntress reported that several Cleo products were being attacked in the wild, including Harmony, VLTrader, and LexiCom. Cleo announced CVE-2024-50623 and that these issues were patched in 5.8.0.21, but Huntress reported the vulnerability was still in those patched versions. Cleo later announced a new vulnerability, CVE-2024-55956, and released patches for it as well.
Rapid7 has released a top-level CVE-2024-55956 analysis covering the issues and an in-deth CVE-2024-55956 technical analysis that found the new vulnerability was patched in version 5.8.0.24 of the three affected products. The Metasploit Framework release this week contains a module for the CVE-2024-55956 vulnerability. If you run Cleo Harmony, VLTrader, and LexiCom, please make sure you are updated to version 5.8.0.24 as soon as possible; patches are available from the vendor.

New module content (3)

Pandora FMS authenticated command injection leading to RCE via LDAP using default DB password

Authors: Askar mhaskar and h00die-gr3y [email protected]
Type: Exploit
Pull request: #19738 contributed by h00die-gr3y
Path: linux/http/pandora_fms_auth_rce_cve_2024_11320
AttackerKB reference: CVE-2024-11320

Description: This adds an exploit module for Pandora FMS having a command injection vulnerability (CVE-2024-11320) in the LDAP authentication mechanism.

Ubuntu needrestart Privilege Escalation

Authors: h00die, makuga01, and qualys
Type: Exploit
Pull request: #19676 contributed by h00die
Path: linux/local/ubuntu_needrestart_lpe
AttackerKB reference: CVE-2024-48990

Description: This adds a post module which exploits needrestart on Ubuntu, before version 3.8. It allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

Cleo LexiCom, VLTrader, and Harmony Unauthenticated Remote Code Execution

Authors: remmons-r7 and sfewer-r7
Type: Exploit
Pull request: #19793 contributed by sfewer-r7
Path: multi/http/cleo_rce_cve_2024_55956
AttackerKB reference: CVE-2024-55956

Description: Add an exploit module for CVE-2024-55956, an unauthenticated file write vulnerability affecting Cleo LexiCom, VLTrader, and Harmony versions 5.8.0.23 and below.

Enhancements and features (2)

• #19734 from h00die – Adds Arch Linux compatibility to the runc_cwd_priv_esc local privilege escalation module.
• #19752 from h00die – This enhancement adds checks for presence of pprof for Prometheus. It can detect potential denial-of-service or information leakage associated with the pprof package.

Bugs fixed (1)

• #19800 from zeroSteiner – Fixes an exception when a custom DNS resolver is used that was preventing SRV records from resolving correctly.

Documentation added (2)

• #19723 from cgranleese-r7 – Add documentation on how to test payload changes when opening pull requests.
• #19794 from jheysel-r7 – Adds documentation clarify what a passive stance module is and how to declare a module passive.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.4.44…6.4.45
• Full diff 6.4.44…6.4.45

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
commercial edition Metasploit Pro

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2024/10/25/metasploit-weekly-wrap-up-10-25-2024/

Hackers and Vampires Agree: Every Byte Counts

Headlining the release today is a new exploit module by jheysel-r7 that chains two vulnerabilities to target Magento/Adobe Commerce systems: the first, CVE-2024-34102 is an arbitrary file read used to determine the version and layout of the glibc library, and the second, CVE-2024-2961 is a single-byte buffer overflow, and it is impressive what can be done with a single byte. By creating an intricate heap layout though specific memory allocation calls in php, an attacker can groom the heap contents in such a way that they can use the single-byte overflow to change a flag in the custom_heap structure, which then results in a system call containing arbitrary data.

New module content (1)

CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)

Authors: Charles Fol, Heyder, Sergey Temnikov, and jheysel-r7
Type: Exploit
Pull request: #19544 contributed by jheysel-r7
Path: linux/http/magento_xxe_to_glibc_buf_overflow
AttackerKB reference: CVE-2024-34102

Description: Adds a new module exploit/linux/http/magento_xxe_to_glibc_buf_overflow which uses a combination of an Arbitrary File Read (CVE-2024-34102) and a Buffer Overflow in glibc (CVE-2024-2961) to gain unauthenticated Remote Code Execution on multiple versions of Magento and Adobe Commerce, including versions less than 2.4.6-p5.

Enhancements and features (2)

• #19536 from GhostlyBox – Updated the post/windows/gather/enum_unattend.rb module to now include checks for ‘.vmimport’ files which may have been created by the AWS EC2 VMIE service which will contain cleartext credentials.
• #19567 from bcoles – Adds default vendor passwords for common single-board computers (SBCs) to wordlists.

Bugs fixed (4)

• #19571 from sjanusz-r7 – Fixes an issue that stopped users from using navigational arrow keys in msfconsole on newer Windows 11 installs.
• #19572 from cdelafuente-r7 – Fixes an issue in the UPDATE action of admin/ldap/ad_cs_cert_template.
• #19576 from adfoster-r7 – Fixes crash when importing a Metasploit xml file with Ruby 3.2 and above.
• #19577 from adfoster-r7 – Fixes a crash when running the shell command with a Meterpreter session.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.4.32…6.4.33
• Full diff 6.4.32…6.4.33

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
commercial edition Metasploit Pro

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2024/07/12/metasploit-weekly-wrap-up-07-12-2024/

The Usual Suspects

This release features two new exploits targeting old friends: Confluence and Ivanti. CVE-2024-21683 is a very easy vulnerability to exploit, but as pointed out in the AttackerKB Review, it requires authentication as a ‘Confluence Administrator.’ On the other hand, CVE-2024-29824 is an unauthenticated SQL Injection in Ivanti Endpoint Manager up to version 2022 SU5 that results in code execution as the NT Service user.

New module content (2)

Atlassian Confluence Administrator Code Macro Remote Code Execution

Authors: Ankita Sawlani, Huong Kieu, W01fh4cker, and remmons-r7
Type: Exploit
Pull request: #19314 contributed by remmons-r7
Path: multi/http/atlassian_confluence_rce_cve_2024_21683
AttackerKB reference: CVE-2024-21683

Description: This adds an exploit for CVE-2024-21683 which is an authenticated RCE in Atlassian Confluence affecting all versions prior to 7.17 and many versions up to 8.9.0.

Ivanti EPM RecordGoodApp SQLi RCE

Authors: Christophe De La Fuente and James Horseman
Type: Exploit
Pull request: #19274 contributed by cdelafuente-r7
Path: windows/http/ivanti_epm_recordgoodapp_sqli_rce
CVE reference: ZDI-24-507

Description: This adds an exploit for CVE-2024-29824, which is unauthenticated SQLi in Ivanti Endpoint Manager 2022 SU5 and prior which can be used to obtain RCE.

Bugs fixed (1)

• #19312 from adfoster-r7 – Fixes a regression issue that caused the Mettle sniffer extension to not correctly load.

Documentation added (2)

• #19301 from adeherdt-r7 – Updates the documentation for setting up developer environments to include running PostgreSQL in a docker container.
• #19315 from h00die – Removes duplicate wording from the setting up a developer environment documentation.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.4.16…6.4.17
• Full diff 6.4.16…6.4.17

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
commercial edition Metasploit Pro

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2024/06/07/metasploit-weekly-wrap-up-06-07-2024/

New OSX payloads:ARMed and Dangerous

In addition to an RCE leveraging CVE-2024-5084 to gain RCE through a WordPress Hash form, this release features the addition of several new binary OSX stageless payloads with aarch64 support: Execute Command, Shell Bind TCP, and Shell Reverse TCP.

The new osx/aarch64/shell_bind_tcp payload opens a listening port on the target machine, which allows the attacker to connect to this open port to spawn a command shell using the user provided command using the execve system call on Apple silicon laptops.

The new osx/aarch64/shell_reverse_tcp payload that can connect back to the configured attacker’s RHOST and RPORT to spawn a command shell using the execve system call on Apple silicon laptops.
The new osx/aarch64/exec payload can execute arbitrary user provided commands using the execve system call on Apple silicon laptops, for example:

msf6 payload(osx/aarch64/exec) > generate -f macho cmd="/bin/bash -c 'echo 123 && echo abc && whoami && echo 🔥'" -o shell
[*] Writing 50072 bytes to shell…

And executing:

$ chmod +x ./shell
$ ./shell
123
abc
user
🔥

New module content (4)

WordPress Hash Form Plugin RCE

Authors: Francesco Carlucci and Valentin Lobstein
Type: Exploit
Pull request: #19208 contributed by Chocapikk
Path: multi/http/wp_hash_form_rce
AttackerKB reference: CVE-2024-5084

Description: This adds an exploit module that leverages a vulnerability in the WordPress Hash Form – Drag & Drop Form Builder plugin (CVE-2024-5084) to achieve remote code execution. Versions up to and including 1.1.0 are vulnerable. This allows unauthenticated attackers to upload arbitrary files, including PHP scripts, due to missing file type validation in the file_upload_action function.

OSX aarch64 Execute Command

Author: alanfoster
Type: Payload (Single)
Pull request: #18646 contributed by AlanFoster
Path: osx/aarch64/exec

Description: Add osx aarch64 exec payload.

OS X x64 Shell Bind TCP

Author: alanfoster
Type: Payload (Single)
Pull request: #18776 contributed by AlanFoster
Path: osx/aarch64/shell_bind_tcp

Description: Add osx aarch64 bind tcp payload.

OSX aarch64 Shell Reverse TCP

Author: alanfoster
Type: Payload (Single)
Pull request: #18652 contributed by AlanFoster
Path: osx/aarch64/shell_reverse_tcp

Description: Add osx aarch64 shell reverse tcp payload.

Enhancements and features (0)

None

Bugs fixed (3)

• #19209 from zgoldman-r7 – Updates multiple file format exploits to show the default settings to users when running show options.
• #19211 from sjanusz-r7 – Fixes an issue were the database management logic would default a model’s updated_at value to incorrectly be set to the created_at value.
• #19217 from zgoldman-r7 – Fixes path tab completion for modules when using Ruby 3.2+.
• #19227 from bcoles – Fixed an issue in Moodle::Login.moodle_login that reported a false negative when logging in with user’s credentials.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.4.11…6.4.12
• Full diff 6.4.11…6.4.12

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
commercial edition Metasploit Pro

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2024/05/31/metasploit-weekly-wrap-up-05-31-2024/

Quis dīrumpet ipsos dīrumpēs

In this release, we feature a double-double: two exploits each targeting two pieces of software. The first pair is from h00die targeting the Jasmine Ransomeware Web Server. The first uses CVE-2024-30851 to retrieve the login for the ransomware server, and the second is a directory traversal vulnerability allowing arbitrary file read. The second pair from Dave Yesland of Rhino Security targets Progress Flowmon with CVE-2024-2389 and it pairs well like wine with the additional and accompanying Privilege Escalation module.

New module content (4)

Jasmin Ransomware Web Server Unauthenticated Directory Traversal

Authors: chebuya and h00die
Type: Auxiliary
Pull request: #19103 contributed by h00die
Path: gather/jasmin_ransomware_dir_traversal
AttackerKB reference: CVE-2024-30851

Description: This adds an unauthenticated directory traversal and a SQLi exploit against the Jasmin ransomware web panel.

Jasmin Ransomware Web Server Unauthenticated SQL Injection

Authors: chebuya and h00die
Type: Auxiliary
Pull request: #19103 contributed by h00die
Path: gather/jasmin_ransomware_sqli

Description: This adds an unauthenticated directory traversal and a SQLi exploit against the Jasmin ransomware web panel.

Flowmon Unauthenticated Command Injection

Author: Dave Yesland with Rhino Security Labs
Type: Exploit
Pull request: #19150 contributed by DaveYesland
Path: linux/http/progress_flowmon_unauth_cmd_injection
AttackerKB reference: CVE-2024-2389

Description: Unauthenticated Command Injection Module for Progress Flowmon CVE-2024-2389.

Progress Flowmon Local sudo privilege escalation

Author: Dave Yesland with Rhino Security Labs
Type: Exploit
Pull request: #19151 contributed by DaveYesland
Path: linux/local/progress_flowmon_sudo_privesc_2024

Description: Privilege escalation module for Progress Flowmon unpatched feature.

Enhancements and features (3)

• #19195 from adfoster-r7 – Updates msfconsole to support risc-v platforms.
• #19198 from adfoster-r7 – Add support for Ruby 3.3.x.
• #19200 from adfoster-r7 – Updates Metasploit’s gemspec file to work with additional static analysis tools.

Bugs fixed (0)

None

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.4.10…6.4.11
• Full diff 6.4.10…6.4.11

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
commercial edition Metasploit Pro

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2024/03/29/metasploit-weekly-wrap-up-03-29-2024/

PHP code execution and Overshare[point]

Here in the Northern Hemisphere, Spring is in the air: flowers, bees, pollen… a new Metasploit 6.4 release, and now, fresh on the heels of this new release is a bountiful crop of exploits, features, and bug-fixes. Leading the pack is a pair of 2024 PHP code execution vulnerabilities in Artica Proxy and the Bricks Builder WordPress theme, and not to be outshone is a pair of Sharepoint vulnerabilities chained to give unauthenticated code execution as administrator.

New module content (3)

Artica Proxy Unauthenticated PHP Deserialization Vulnerability

Authors: Jaggar Henry of KoreLogic Inc. and h00die-gr3y [email protected]
Type: Exploit
Pull request: #18967 contributed by h00die-gr3y
Path: linux/http/artica_proxy_unauth_rce_cve_2024_2054
AttackerKB reference: CVE-2024-2054

Description: The PR adds a module targeting CVE-2024-2054, a command injection vulnerability in Artica Proxy appliance version 4.50 and 4.40. The exploit allows remote unauthenticated attackers to run arbitrary commands as the www-data user.

Unauthenticated RCE in Bricks Builder Theme

Authors: Calvin Alkan and Valentin Lobstein
Type: Exploit
Pull request: #18891 contributed by Chocapikk
Path: multi/http/wp_bricks_builder_rce
AttackerKB reference: CVE-2024-25600

Description: This PR adds an exploit module that targets a known vulnerability, CVE-2024-25600, in the WordPress Bricks Builder Theme, versions prior to 1.9.6.

Sharepoint Dynamic Proxy Generator Unauth RCE

Authors: Jang and jheysel-r7
Type: Exploit
Pull request: #18721 contributed by jheysel-r7
Path: windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce
AttackerKB reference: CVE-2023-24955

Description: This PR adds a module that allows unauthenticated remote code execution as Administrator on Sharepoint 2019 hosts. It performs this by exploiting two vulnerabilities in Sharepoint 2019. First, it uses CVE-2023-29357, an auth bypass patched in June of 2023 to impersonate the Administrator user, then it uses CVE-2023-24955, an RCE patched in May of 2023 to execute commands as Administrator.

Enhancements and features (4)

• #18925 from sjanusz-r7 – Updates RPC API to include Auxiliary and Exploit modules in session.compatible_modules response.
• #18982 from ekalinichev-r7 – Adds RPC methods session.interactive_read and session.interactive_write that support interaction with SQL, SMB, and Meterpreter sessions via RPC API.
• #19016 from zgoldman-r7 – Updates the MSSQL modules to support the GUID column type. This also improves error logging.
• #19017 from zgoldman-r7 – Improves the auxiliary/admin/mssql/mssql_exec and auxiliary/admin/mssql/mssql_sql modules to have improved error logging.

Bugs fixed (6)

• #18985 from cgranleese-r7 – Fixes store_valid_credential conditional logic for unix/webapp/wp_admin_shell_upload module.
• #18992 from adfoster-r7 – Fixes a crash within the postgres version module.
• #19006 from cgranleese-r7 – This fixes an issue where WMAP plugin module loading was causing failures.
• #19009 from sjanusz-r7 – Updates modules/exploits/osx/local/persistence to no longer be marked as a compatible module for Windows targets.
• #19012 from zeroSteiner – This fixes an issue that was reported where msfconsole will fail to start if the user’s /etc/hosts file contained a host name ending in a . or containing _ characters.
• #19015 from zeroSteiner – Previously, we fixed an issue where Metasploit would crash while parsing the hosts file if it ended in unexpected values like . or _. This fixes the same kind of issue in DNS names that enter the hostnames data through a different path by removing any trailing . so they can be used for DNS resolution.

Documentation added (1)

• #18961 from zgoldman-r7 – This adds documentation for the new SQL and SMB session types.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.4.0…6.4.1
• Full diff 6.4.0…6.4.1

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
commercial edition Metasploit Pro

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2024/01/19/metasploit-weekly-wrap-up-01-19-24/

Unicode your way to a php payload and three modules to add to your playbook for Ansible

Our own jheysel-r7 added an exploit leveraging the fascinating tool of php filter chaining to prepend a payload using encoding conversion characters and h00die et. al. have come through and added 3 new Ansible post modules to gather configuration information, read files, and deploy payloads. While none offer instantaneous answers across the universe, they will certainly help in red team exercises.

New module content (4)

Ansible Agent Payload Deployer (1 of 3 Ansible post modules)

Authors: h00die and n0tty
Type: Exploit
Pull request: #18627 contributed by h00die
Path: linux/local/ansible_node_deployer

Ansible Config Gather (2 of 3 Ansible post modules)

Author: h00die
Type: Post
Pull request: #18627 contributed by h00die
Path: linux/gather/ansible

Ansible Playbook Error Message File Reader (3 of 3 Ansible post modules)

Authors: h00die and rioasmara
Type: Post
Pull request: #18627 contributed by h00die
Path: linux/gather/ansible_playbook_error_message_file_reader

Description: This adds 3 post-exploitation modules for Ansible. The first one gathers information and configuration. The second exploits an arbitrary file read that enables an attacker to read the first line of a file (typically /etc/shadow), when the compromised account is configured with password-less sudo permissions. The last one is an exploit that can deploy a payload to all the nodes in the network.

WordPress Backup Migration Plugin PHP Filter Chain RCE

Authors: Nex Team, Valentin Lobstein, and jheysel-r7
Type: Exploit
Pull request: #18633 contributed by jheysel-r7
Path: multi/http/wp_backup_migration_php_filter

Description: This adds an exploit module that leverages an unauthenticated RCE in the WordPress plugin Backup Migration versions prior to 1.3.7. This vulnerability is identified as CVE-2023-6553. This also adds a library that implements a technique called PHP Filter Chaining which allows an attacker to prepend bytes to a string by continuously chaining character encoding conversion.

Enhancements and features (2)

• #18596 from dwelch-r7 – Updates multiple SMB modules to work with the new upcoming SMB session type support. This beta functionality is currently behind a feature flag, and can be enabled with features set smb_session_type true.
• #18682 from adfoster-r7 – Add tests for Msf::Exploit::Local module types to ensure that sysinfo will not break again in the future.

Bugs fixed (2)

• #18655 from adfoster-r7 – Ensures the module will automatically be used when the hierarchical search functionality is enabled and only one module result is found.
• #18710 from adfoster-r7 – Fixes an uninitialized constant Msf::Simple::Exploit::ExploitDriver exception that could sometimes occur when running Metasploit framework’s payload modules.

Documentation added (1)

• #18702 from Sh3llSp4wn – Updates the documentation for the private and public fields in lib/metasploit/framework/credential.rb to be correct.

You can always find more documentation on our docsite at docs.metasploit.com.

Missing rn-* label on Github (1)

PLEASE ADD RN-TAGS TO THESE PULL REQUESTS BEFORE RELEASING THE WRAP UP, AND RERUN THE WRAPUP SCRIPT

• #18398 from errorxyz – Fixes deprecation warnings when running the auxiliary/admin/scada/modicon_password_recovery, auxiliary/scanner/lotus/lotus_domino_hashes, auxiliary/sniffer/psnuffle, exploits/unix/webapp/vbulletin_vote_sqli_exec exploit modules with a database connected.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.51…6.3.52
• Full diff 6.3.51…6.3.52

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
commercial edition Metasploit Pro

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2023/12/15/metasploit-weekly-wrap-up-38/

Continuing the 12th Labor of Metasploit

Metasploit continues its Herculean task of increasing our toolset to tame Kerberos by adding support for AS_REP Roasting, which allows retrieving the password hashes of users who have Do not require Kerberos preauthentication set on the domain controller. The setting is disabled by default, but it is enabled in some environments.

Attackers can request the hash for any user with that option enabled, and worse (or better?) you can query the DC to determine which accounts have this setting, so not only can you get these hashes, the DC will tell you which users are vulnerable to the attack. Metasploit’s AS_REP roasting module will both gather the users and pull the authentication information, or pull information on a select set of users.

Ticket Management

This week’s release includes a brand new post module for enumerating and dumping Kerberos tickets from a compromised Windows host. This module will copy all of the tickets that are accessible based on the current privilege level to Metasploit’s own cache, where they can then be used in a Pass-The-Ticket (PTT) style attack. This notably enables Metasploit users to execute the entire workflow necessary to exploit Unconstrained Delegation right from with Metasploit, there’s even new documentation which outlines the entire process.

New module content (3)

Find Users Without Pre-Auth Required (ASREP-roast)

Author: smashery
Type: Auxiliary
Pull request: #18569 contributed by smashery
Path: gather/asrep

Description: This adds a module to gather credential material from accounts with "Requires Pre-Authentication" disabled. The module supports two mechanisms, brute forcing using a list of usernames or using a LDAP query to request the relevant usernames, followed by requesting TGTs.

Splunk Authenticated XSLT Upload RCE

Authors: Valentin Lobstein, h00die, and nathan
Type: Exploit
Pull request: #18577 contributed by Chocapikk
Path: unix/http/splunk_xslt_authenticated_rce

Description: This PR adds a Remote Code Execution (RCE) module for Splunk Enterprise using CVE-2023-46214. This module exploits a vulnerability in the XSLT transformation functionality of certain versions of Splunk Enterprise, allowing for authenticated remote code execution.

Kerberos Ticket Management

Authors: Spencer McIntyre and Will Schroeder
Type: Post
Pull request: #18488 contributed by zeroSteiner
Path: windows/manage/kerberos_tickets

Description: This PR adds a module to manage Kerberos tickets from a compromised host. This notably allows Kerberos tickets to be exported from the target and then added to Metasploit’s own cache, allowing them to be used for the duration in which they are valid.

Enhancements and features (3)

• #18539 from dwelch-r7 – This adds a new session type for SMB sessions. The smb session is behind a feature flag and can be enabled by setting features set smb_session_type true in msfconsole.
• #18598 from bwatters-r7 – :
  This bumps the Metasploit-payload version to bring in one fix and one enhancement. The fix is to standardize the behavior of Java Meterpreter to only listen on IPv4 interfaces when binding to 0.0.0.0. The enhancement is to better align pretty OS names on Windows for Windows Kernel 10 releases, AKA Windows server 2016-present or Windows 10/11+.
• #18601 from MikeAnast – Adds arm64 support to Metasploit’s Dockerfile. This new image is available from Dockerhub via docker pull metasploitframework/metasploit-framework:6.3.47 or through the wrapper script ./docker/bin/msfconsole.

Bugs fixed (4)

• #18606 from Lorenyx – rpc_plugin has been updated to correctly use the provided plugin options.
• #18609 from adfoster-r7 – This fixes an issue in the cmd/windows/powershell/download_exec payload module that was preventing it from executing correctly due to an architecture check.
• #18613 from dwelch-r7 – Ensures that after listing files within an SMB directory that the handle is closed.
• #18614 from sjanusz-r7 – Fixes a crash in the auxiliary/scanner/ssh/ssh_identify_pubkeys module, as well as adding new module documentation.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.46…6.3.47
• Full diff 6.3.46…6.3.47

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
commercial edition Metasploit Pro

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2023/11/10/metasploit-weekly-wrap-up-35/

Apache MQ and Three Cisco Modules in a Trenchcoat

This week’s release has a lot of new content and features modules targeting two major recent vulnerabilities that got a great deal of attention: CVE-2023-46604 targeting Apache MQ resulting in ransomware deployment and CVE-2023-20198 targeting Cisco IOS XE OS.

New module content (8)

Cisco IOS-XE unauthenticated Command Line Interface (CLI) execution

Author: sfewer-r7
Type: Auxiliary
Pull request: #18507 contributed by sfewer-r7
Path: admin/http/cisco_ios_xe_cli_exec_cve_2023_20198

Description: This PR adds three modules: auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198 leverages CVE-2023-20198 to perform unauthenticated remote CLI command execution, module auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273 leverages both CVE-2023-20198 and CVE-2023-20273 to perform unauthenticated remote OS command execution, and exploit/linux/misc/cisco_ios_xe_rce uses the same two vulnerabilities to run an arbitrary payload on the target.

MagnusBilling application unauthenticated Remote Command Execution.

Authors: Eldstal and h00die-gr3y [email protected]
Type: Exploit
Pull request: #18481 contributed by h00die-gr3y
Path: linux/http/magnusbilling_unauth_rce_cve_2023_30258

Description: This adds an exploit module that leverages CVE-2023-30258, a command injection vulnerability in MagnusBilling versions 6 and 7 that allows unauthenticated remote code execution in the context of the user running the web server process.

Apache ActiveMQ Unauthenticated Remote Code Execution

Authors: X1r0z and sfewer-r7
Type: Exploit
Pull request: #18501 contributed by sfewer-r7
Path: multi/misc/apache_activemq_rce_cve_2023_46604

Description: This pull request is an exploit module for CVE-2023-46604, affecting the OpenWire transport unmarshaller in Apache ActiveMQ.

AjaxPro Deserialization Remote Code Execution

Authors: Hans-Martin Münch (MOGWAI LABS) and Jemmy Wang
Type: Exploit
Pull request: #18494 contributed by Jemmy1228
Path: windows/http/ajaxpro_deserialization_rce

Description: This PR adds an RCE module for AjaxPro which leverages an insecure deserialization of data to get remote code execution on the target OS in the context of the user running the website which utilized AjaxPro.

Apache NiFi Credentials Gather

Authors: Topaco and h00die
Type: Post
Pull request: #18503 contributed by h00die
Path: linux/gather/apache_nifi_credentials

Description: This PR adds a post module to steal config and credential information for Apache NiFi.

Windows Gather PL/SQL Developer Connection Credentials

Authors: Adam Caudill and Jemmy Wang
Type: Post
Pull request: #18491
Path: windows/gather/credentials/plsql_developer

Description: Unable to find PR information, please complete manually

Enhancements and features (3)

• #18218 from gardnerapp – This PR reduces the number of requests the Windows checkvm post module sends to the host when attempting to determine what hypervisor the session is running in by saving the initial responses in instance variables for later use in the module. The PR also includes many other general code improvements.
• #18379 from dwelch-r7 – This PR improves the Kerberos service authenticator hostname matching for ccache credentials. Prior to this change the service authenticator was filtering out valid credentials when the hostname wasn’t an exact match when credentials for a domain (i.e. windomain.local) should work on a subdomain (i.e. dc.windomain.local).
• #18504 from h00die – Updates the auxiliary/scanner/http/grafana_plugin_traversal module to include a disclosure date and a link to the original disclosure blog post.

Bugs fixed (1)

• #18506 from zeroSteiner – This PR fixes a stability issue with the f5_bigip_tmui_rce_cve_2023_46747 module. Prior to this fix, occasionally the module would fail on login as things were running too quickly. The module now retries logging in if the first attempt fails.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.41…6.3.42
• Full diff 6.3.41…6.3.42

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2023/10/19/metasploit-weekly-wrap-up-32/

That Privilege Escalation Escalated Quickly

This release features a module leveraging CVE-2023-22515, a vulnerability in Atlassian’s on-premises Confluence Server first listed as a privilege escalation, but quickly recategorized as a “broken access control” with a CVSS score of 10. The exploit itself is very simple and easy to use so there was little surprise when CISA published an advisory stating that threat actors were using it in the wild. It is imperative that anyone using the affected versions mitigate risk and patch as quickly as possible.

Improved sessions searching

This release enhances the sessions command with additional search filters, for instance:

sessions -S 'sesion_id:1 session_id:5'
sessions -S 'session_type:meterpreter'
sessions -S 'last_checkin:greater_than:1h10m last_checkin:less_than:2h'

These search options can be used in conjunction with other session options. For instance the --verbose flag:

msf6 exploit(windows/smb/psexec) > sessions -S 'last_checkin:greater_than:2h30m' -v

Active sessions
===============

  Session ID: 8
        Name: 
        Type: meterpreter windows
        Info: NT AUTHORITY\SYSTEM @ WINDEV
      Tunnel: 192.168.123.1:4444 -> 192.168.123.132:50564 (192.168.123.132)
         Via: exploit/windows/smb/psexec
   Encrypted: Yes (AES-256-CBC)
        UUID: 4d78f75abbdbf0c8/x86=1/windows=1/2023-10-19T19:44:23Z
     CheckIn: 18003s ago @ 2023-10-19 15:45:30 +0100
  Registered: No

  Session ID: 9
        Name: 
        Type: meterpreter windows
        Info: NT AUTHORITY\SYSTEM @ WINDEV
      Tunnel: 192.168.123.1:4444 -> 192.168.123.132:50565 (192.168.123.132)
         Via: exploit/windows/smb/psexec
   Encrypted: Yes (AES-256-CBC)
        UUID: 48d32692e0633293/x86=1/windows=1/2023-10-19T19:44:23Z
     CheckIn: 10803s ago @ 2023-10-19 17:45:30 +0100
  Registered: No

Or as an easy way to search for and kill matching stale sessions with --kill-all:

msf6 exploit(windows/smb/psexec) > sessions -S 'last_checkin:greater_than:2h30m' -K
[*] Killing matching sessions...

Active sessions
===============

  Id  Name  Type                     Information                   Connection
  --  ----  ----                     -----------                   ----------
  4         meterpreter x86/windows  NT AUTHORITY\SYSTEM @ WINDEV  192.168.123.1:4444 -> 192.168.123.132:50540 (192.168.123.132)
  5         meterpreter x86/windows  NT AUTHORITY\SYSTEM @ WINDEV  192.168.123.1:4444 -> 192.168.123.132:50555 (192.168.123.132)

[*] 192.168.123.132 - Meterpreter session 4 closed.
[*] 192.168.123.132 - Meterpreter session 5 closed.

New module content (2)

Apache Superset Signed Cookie RCE

Authors: Naveen Sunkavally, Spencer McIntyre, h00die, and paradoxis
Type: Exploit
Pull request: #18351 contributed by h00die
Path: linux/http/apache_superset_cookie_sig_rce

Description: This adds an exploit for CVE-2023-37941 which is an authenticated RCE in Apache Superset.

Atlassian Confluence Unauthenticated Remote Code Execution

Author: sfewer-r7
Type: Exploit
Pull request: #18461 contributed by sfewer-r7
Path: multi/http/atlassian_confluence_rce_cve_2023_22515

Description: This adds an exploit module that leverages an improper input validation issue in Atlassian Confluence versions between 8.0.0 through to 8.3.2, 8.4.0 through to 8.4.2, and 8.5.0 through to 8.5.1. This vulnerability is identified as CVE-2023-22515 and allows unauthenticated remote code execution. The module first creates a new administrator by abusing the embedded XWorks2 middleware and uploading a malicious plugin to get code execution. Note that the module is currently not able to delete the new administrator account it created. This would require a manual clean up.

Enhancements and features (7)

• #17689 from manishkumarr1017 – Adds an additional column to the creds command to additionally show any cracked passwords that have been created by the auxiliary/analyze/crack_databases module or similar.
• #18364 from zgoldman-r7 – Add support for filtering sessions based on last checkin time, session type and id.
• #18381 from sjanusz-r7 – Adds new options -r and --reload-libs to the check, recheck, to_handler, reload, run and rerun commands. This new option will reload all library files before performing the original command.
• #18428 from AleksaZatezalo – This PR adds documentation for the mssql_login module.
• #18438 from adfoster-r7 – Makes improvements to the UX for database management prompts. Now when running msfdb init the user is no longer prompted for database deletion. The message for clearing unused data service credentials has been reworded.
• #18450 from adfoster-r7 – Adds support for Ruby 3.3.0-preview2.
• #18451 from adfoster-r7 – Updates the newly added cracked password column as part of the creds to work with the remote database.

Bugs fixed (3)

• #18442 from adfoster-r7 – Improves stability of msfdb initialization on windows environments. Previously the msfdb init script would hang indefinitely on Windows environments, as well as there being false negatives on detecting if the database was running or not.
• #18443 from adfoster-r7 – Adds a fix for the handler/reverse_ssh module that was returning warnings when msfconsole was booted on a Windows machine.
• #18449 from adfoster-r7 – Fixes an issue with the scanner/mysql/mysql_authbypass_hashdump module to now correctly close sockets.

Documentation added (1)

• #18452 from jheysel-r7 – Updates the Metasploit Wiki to include information on how to run quality tools on module documentation.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.38…6.3.39
• Full diff 6.3.38…6.3.39

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2023/09/01/metasploit-weekly-wrap-up-25/

Pumpkin Spice Modules

Here in the northern hemisphere, fall is on the way: leaves changing, the air growing crisp and cool, and some hackers changing the flavor of their caffeine. This release features a new exploit module targeting Apache NiFi as well as a new and improved library to interact with it.

New module content (1)

Apache NiFi H2 Connection String Remote Code Execution

Authors: Matei "Mal" Badanoiu and h00die
Type: Exploit
Pull request: #18257 contributed by h00die
Path: exploits/linux/http/apache_nifi_h2_rce
AttackerKB reference: CVE-2023-34468

Description: This adds an exploit module for a Apache NiFi h2 remote code execution identified as CVE-2023-34468. Versions 0.0.2 through 1.21.0 are vulnerable and allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. This also adds a library with helper functions for modules targeting this product.

Enhanced Modules

Modules which have either been enhanced, or renamed:

Elasticsearch Enumeration Utility

Authors: Silas Cutler and h00die
Type: Auxiliary
Pull request: #18310 contributed by h00die
Path: auxiliary/gather/elasticsearch_enum

Description: This updates the Elasticsearch auxiliary module. It has been renamed to elastic_enum, accepts credentials and will store data to disk that is pulled from the target.

• #18247 from EgeBalci – This adds an exploit module that leverages an authentication bypass and an arbitrary file upload in Netgear ProSAFE NMS300. These vulnerabilities have been identified as CVE-2023-38096 and CVE-2023-38098 respectively and affects versions below 1.7.0.22. By chaining together these vulnerabilities, an unauthenticated remote attacker can execute arbitrary code with SYSTEM privileges.

Enhancements and features (1)

• #18309 from zeroSteiner – This updates the ldap_query module to stream the results instead of collecting them all at once. This should improve the UX of using the module in large target environments with 10s of thousands of accounts and the like.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.31…6.3.32
• Full diff 6.3.31…6.3.32

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2023/08/25/metasploit-weekly-wrap-up-24/

Power[shell]Point

This week’s new features and improvements start with two new exploit modules leveraging CVE-2023-34960 Chamilo versions 1.11.18 and below and CVE-2023-26469 in Jorani 1.0.0. Like CVE-2023-34960, I too, feel attacked by PowerPoint sometimes.
We also have several improvements, including additions to fetch payloads, PostgreSQL authentication, and documentation.

New module content (2)

Chamilo unauthenticated command injection in PowerPoint upload

Authors: Randorisec and h00die-gr3y
Type: Exploit
Pull request: #18233 contributed by h00die-gr3y
Path: exploits/linux/http/chamilo_unauth_rce_cve_2023_34960
AttackerKB reference: CVE-2023-34960

Description: This adds an exploit module that leverages an unauthenticated remote command execution vulnerability Chamilo versions 1.11.18 and below. This vulnerability is identified as CVE-2023-34960. Due to a functionality called Chamilo Rapid to easily convert PowerPoint slides to courses on Chamilo, it is possible for an unauthenticated remote attacker to execute arbitrary commands at OS level using a malicious SOAP request at the vulnerable endpoint /main/webservices/additional_webservices.php.

Jorani unauthenticated Remote Code Execution

Author: RIOUX Guilhem (jrjgjk)
Type: Exploit
Pull request: #18123 contributed by Guilhem7
Path: exploits/multi/php/jorani_path_trav
AttackerKB reference: CVE-2023-26469

Description: This PR adds a module that chains together a log poisoning LFI redirection bypass and a path traversal vulnerability to obtain unauthenticated RCE.

Enhancements and features (4)

• #18214 from bwatters-r7 – This makes two improvements to the fetch payloads. The first improvement is that the FETCH_SRVHOST option will be set to LHOST when LHOST is set and FETCH_SRVHOST is not, meaning there is now one less option users need to set when using a payload with a reverse stager. The second improvement is that the default command for the Windows HTTP payload has been changed to CERTUTIL which will offer better compatibility with older versions of Windows than the previous CURL command. The HTTPS and TFTP payloads will still default to CURL.
• #18276 from adfoster-r7 – Updates all PostgreSQL modules to now support a newer form of authentication (SASL-SCRAM-256) that pen testers are seeing in the wildnow more frequently seeing in the wild. This includes the modules for PostgreSQL authentication brute force, version fingerprinting, running queries, etc.
• #18307 from ismaildawoodjee – This fixes documentation typos with the exploit/multi/http/subrion_cms_file_upload_rce module.
• #18308 from ismaildawoodjee – Improves the readability of documentation/modules/exploit/windows/http/smartermail_rce.

Bugs fixed (5)

• #18272 from sfewer-r7 – This fixes an issue in the exploit module multi/http/adobe_coldfusion_rce_cve_2023_26360 when the target ColdFusion server is deployed with a Development profile.
• #18287 from zeroSteiner – This fixes a stack trace thrown by the forge_ticket module when the SPN datastore option was left blank. The module now fails due to bad-config and gives a detailed error message.
• #18297 from adfoster-r7 – This fixes the broken scanner/mysql/mysql_authbypass_hashdump module and adds documentation for the module.
• #18298 from adfoster-r7 – Changes the behavior of setting LHOST as an interface name, for example with set LHOST eth0. Previously, a non-deterministic IP would be resolved from the adapter name if the adapter had multiple IPv4/IPv6 addresses registered. Now the lowest ordinal IPv4 addresses is preferenced first, followed by any IPv6 addresses.
• #18306 from zeroSteiner – Fixes a crash when parsing ThriftHeader binary data.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.30…6.3.31
• Full diff 6.3.30…6.3.31

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2023/06/30/metasploit-weekly-wrap-up-17/

Nothing but .NET?

Smashery continues to… smash it by updating our .NET assembly execution module. The original module allowed users to run a .NET exe as a thread within a process they created on a remote host. Smashery’s improvements let users run the executable within a thread of the process hosting Meterpreter and also changed the I/O for the executing thread to support pipes, allowing interaction with the spawned .NET thread, even when the other process has control over STDIN and STDOUT. The changes add more stealth, better I/O, more injection options, and reliability improvements.

Want to be the next exploit, module, research, and wrapup author?

We’re hiring a Security Researcher to develop high-quality modules and produce research that continues to inspire contributions and interest from a growing community. This role can be based on any of the following Rapid7 Offices: Austin TX, Boston MA, Arlington V, Boston MA, Tampa FL, Dublin, or our new Prague office! Seniority level is also flexible depending on experience and team fit.

New module content (1)

Apache Druid JNDI Injection RCE

Authors: Jari Jääskelä and RedWay Security
Type: Exploit
Pull request: #18134 contributed by heyder
AttackerKB reference: CVE-2023-25194

This PR adds a module which exploits CVE-2023-25194, an unauthenticated deserialization vulnerability which leads to RCE in Apache Druid.

Enhancements and features (5)

• #17796 from sempervictus – This adds reporting to the Framework database for the AWS EC2 enumeration module.
• #17901 from dwelch-r7 – Adds additional payload module metadata to Metasploit’s JSON module cache to improve msfconsole’s bootup time.
• #17959 from jmartin-r7 – The login scanner modules have been updated to catch any exceptions that may be raised when testing a credential. Additionally, the SNMP scanner and PostgreSQL scanners have been updated to catch additional errors that may be thrown when testing credentials.
• #18114 from smashery – This updates the post/windows/manage/execute_dotnet_assembly module to allow it to run the .NET assembly within the current process. The module can now also read the output from all injection techniques.
• #18133 from smashery – This improves the execute_dotnet_assembly module’s ability to correctly identify the signature of the main method. Users no longer need to know and specify it themselves.

Bugs fixed (4)

• #18065 from cgranleese-r7 – Updates the jenkins_gather module to work with newer version of Jenkins.
• #18121 from zeroSteiner – Adds a proper ASN.1 parser using RASN1 for the x509 SubjectAltName field.
• #18139 from adfoster-r7 – A intermittent segfault issue when running the getuid command within a Windows Python Meterpreter has been fixed.
• #18146 from adfoster-r7 – Fixes an intermittent issue with Windows Meterpreter which caused ‘Access Denied’ errors when Meterpreter attempted to get or set the clipboard data when either the user or another application was also manipulating the same clipboard.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.22…6.3.23
• Full diff 6.3.22…6.3.23

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).