Dean Welch – Noise

Metasploit Weekly Wrap-Up

Dean Welch — Fri, 03 Nov 2023 19:10:16 +0000

PTT for DCSync

This week, community member smashery made an improvement to the windows_secrets_dump module to enable it to dump domain hashes using the DCSync method after having authenticated with a Kerberos ticket. Now, if a user has a valid Kerberos ticket for a privileged account, they can

Metasploit Weekly Wrap-Up

Dean Welch — Fri, 07 Jul 2023 19:26:23 +0000

Apache RocketMQ

We saw some great teamwork this week from jheysel-r7 and h00die to bring you an exploit module for CVE-2023-33246.
In Apache RocketMQ version 5.1.0 and under, there is an access control issue which the module leverages to update the broker's configuration file without authentication. From here

Metasploit Weekly Wrap-Up

Dean Welch — Fri, 21 Apr 2023 18:02:40 +0000

VMware Workspace ONE Access exploit chain

A new module contributed by jheysel-r7 exploits two vulnerabilities in VMware Workspace ONE Access to attain Remote Code Execution as the horizon user.
First being CVE-2022-22956, which is an authentication bypass and the second being a JDBC injection in the form of CVE-2022-22957 ultimately

Metasploit Weekly Wrap-Up

Dean Welch — Fri, 03 Feb 2023 19:21:26 +0000

Metasploit 6.3 is out!

Earlier this week we announced the release of Metasploit 6.3 which came with a tonne of new modules and improvements.
The whole team worked super hard on this and we're very excited that everyone can now get their hands on it and all of

Metasploit Weekly Wrap-Up

Dean Welch — Fri, 30 Sep 2022 18:47:25 +0000

Veritas Backup Exec Agent RCE

This module kindly provided by c0rs targets the Veritas Backup Exec Agent in order to gain RCE as the system/root user.
The exploit itself is actually a chain of 3 separate CVEs (CVE-2021-27876, CVE-2021-27877 and CVE-2021-27878) which only makes it more impressive.
While you're

Metasploit Weekly Wrap-Up

Dean Welch — Fri, 08 Jul 2022 18:35:21 +0000

DFSCoerce - Distributing more than just files

DFS (Distributed File System) is now distributing Net-NTLM credentials thanks to Spencer McIntyre with a new auxiliary/scanner/dcerpc/dfscoerce module that is similar to PetitPotam in how it functions. Note that unlike PetitPotam, this technique does require a normal domain user’s

Metasploit Weekly Wrap-Up

Dean Welch — Fri, 22 Apr 2022 16:44:10 +0000

ManageEngine ADSelfService Plus Authenticated RCE

This module is pretty exciting for us because it's for a vulnerability discovered by our very own Rapid7 researchers Jake Baines, Hernan Diaz, Andrew Iwamaye, and Dan Kelly.
The vulnerability allowed for attackers to leverage the "custom script" functionality to execute arbitrary operating

Metasploit weekly wrap-up

Dean Welch — Fri, 28 Jan 2022 16:49:49 +0000

A new Log4Shell module for unauthenticated RCE on Ubiquiti UniFi devices, getsystem improvements, and more!

Metasploit Wrap-Up

Dean Welch — Fri, 22 Oct 2021 14:25:55 +0000

Metasploit's first modules targeting Kubernetes, plus Windows support for exploiting Confluence Server CVE-2021-26084.

Metasploit Wrap-Up

Dean Welch — Fri, 22 Jan 2021 19:21:10 +0000

A new Microsoft Windows Spooler privesc module, along with some fixes and improvements!