Metasploit Wrap-Up
Silly admin, Citrix is for script kiddies A hot, new module has landed in Metasploit Framework this week. It takes advantage of CVE-2019-19781 which is a directory traversal vulnerability in Citrix Application Delivery Controller (ADC) and Gateway. This exploit takes advantage of unsanitized input within…
Metasploit Wrap-Up
A new OpenBSD local exploit Community contributor bcoles brings us a new exploit module for CVE-2019-19726, a vulnerability originally discovered by Qualys in OpenBSD. This vulnerability is pretty interesting in the sense that it leverages a bug in the _dl_getenv function that can be…
Metasploit Wrap-Up
With 2019 almost wrapped up, we’ve been left wondering where the time went! It’s been a busy year for Metasploit, and we’re going out on a reptile-themed note this wrap-up... Python gets compatible With the clock quickly ticking down on Python 2…
Metasploit Wrap-Up
It’s beginning to look a lot like HaXmas, everywhere you go! We have a great selection of gift-wrapped modules this holiday season, sure to have you entertained from one to eight nights, depending on your preference! On a personal note, we here at the…
Metasploit Wrap-Up
Powershell Express Delivery The web_delivery module is often used to deliver a payload during post exploitation by quickly firing up a local web server. Since it does not write anything on target’s disk, payloads are less likely to be caught by anti-virus protections.…
Metasploit Wrap-Up
Management delegation of shells Onur ER contributed the Ajenti auth username command injection exploit module for the vulnerability Jeremy Brown discovered and published a PoC for on 2019-10-13 (EDB 47497) against Ajenti version 2.1.31. Ajenti is an open-source web-based server admin panel written…
Metasploit Wrap-Up
Payload payday As we blogged about yesterday, a new form of payload that is compiled directly from C when generated was added by space-7. We hope this is only the first step in a journey of applying the myriad tools that obfuscate C programs to…
Metasploit Wrap-Up
Pulse Secure VPN exploit modules, a notable BlueKeep exploit reliability improvement, and an overhaul of MSF's password cracking integration, including new support for hashcat.…
Metasploit Wrap-Up
Config R Us Many versions of network management tool rConfig are vulnerable to unauthenticated command injection, and contributor bcoles added a new exploit module for targeting those versions. Present in v3.9.2 and prior, this vulnerability centers around the install directory not being automatically…
Metasploit Wrap-Up
This week's Metasploit wrap-up ships a new exploit module against Nostromo, a directory traversal vulnerability that allows system commands to be executed remotely. Also, improvements have been made for the grub_creds module for better post exploitation experience against Unix-like machines. Plus a few bugs…
Metasploit Wrap-Up
Is URGENT/11 urgent to your world? Metasploit now has a scanner module to help find the systems that need URGENT attention. Be sure to check the options on this one; RPORTS is a list to test multiple services on each target. Thanks Ben Seri…
Metasploit Wrap-up
Nagios XI post module Nagios XI may store the credentials of the hosts it monitors, and with the new post module by Cale Smith, we're now able to extract the Nagios database content along with its SSH keys and dump them into the MSF database.…
Metasploit Wrap-up
Exploiting Windows tools There are two new Windows modules this week, both brought to you by the Metasploit team. The Windows Silent Process Exit Persistence module, from our own bwatters-r7, exploits a Windows tool that allows for debugging a specified process on exit. With escalated…
Metasploit Wrap-Up
Command and Control with DOUBLEPULSAR We now have a DOUBLEPULSAR exploit module thanks to some amazing work by our own wvu, Jacob Robles, and some significant contributions from the wider community. The module allows you to check for the DOUBLEPULSAR implant, disable it, or even…
Metasploit Wrap-Up
BlueKeep is Here The BlueKeep exploit module is now officially a part of Metasploit Framework. This module reached merged status thanks to lots of collaboration between Rapid7 and the MSF community members. The module requires some manual configuration per target, and targets include both virtualized…
