Erin Bleiweiss – Noise

Metasploit Weekly Wrap-Up

Erin Bleiweiss — Fri, 13 May 2022 16:52:59 +0000

Spring4Shell module

Community contributor vleminator added a new module which exploits CVE-2022-22965—more commonly known as "Spring4Shell." Depending on its deployment configuration, Java Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older can be vulnerable to unauthenticated remote

Metasploit Weekly Wrap-Up

Erin Bleiweiss — Fri, 18 Feb 2022 21:24:12 +0000

Nagios XI web shell upload module

New this week is a Nagios Web Shell Upload module from Rapid7' own Jake Baines, which exploits CVE-2021-37343. This module builds upon the existing Nagios XI scanner written by Erik Wynter. Versions of Nagios XI prior to 5.8.5 are vulnerable to a

Metasploit Wrap-Up

Erin Bleiweiss — Fri, 19 Nov 2021 19:51:17 +0000

Azure Active Directory login scanner module

Community contributor k0pak4 added a new login scanner module for Azure Active Directory. This module exploits a vulnerable authentication endpoint in order to enumerate usernames without generating log events. The error code returned by the endpoint can be used to discover the validity of

Metasploit Wrap-Up

Erin Bleiweiss — Fri, 13 Aug 2021 18:25:09 +0000

Three new modules that deliver RCE on Atlassian Crowd and privilege escalation to SYSTEM via print drivers. Plus, a new command shell session type for SSH clients and plenty more enhancements and fixes.