Quick Cookie Notification

This site uses cookies, including for analytics, personalization, and advertising purposes. For more information or to change your cookie settings, click here.

If you continue to browse this site without changing your cookie settings, you agree to this use.


View Cookie Policy for full details

Rapid7 Blog

Metasploit Weekly Wrapup  

Metasploit Wrap-Up

Injecting the Time Machine From contributor timwr comes a new module targeting Time Machine on macOS 10.14.3 and earlier. Specifically, the tmdiagnose binary for these vulnerable versions suffers from a command injection vulnerability that can be exploited via a specially crafted disk label.…

Metasploit Wrap-Up

I am Root An exploit module for Nagios XI v5.5.6 was added by community contributor yaumn. This module includes two exploits chained together to achieve code execution with root privileges, and it all happens without authentication. A single unsanitized parameter in magpie_debug.…

Metasploit Wrap-Up

TLS support and expanded options for the BlueKeep scanner module, two new modules for Cisco Prime Infrastructure, and more.…

Metasploit Wrap-Up

It’s Summertime, and the Hackin’ is Easy It is still early in the season, but there’s a whole lot of fixes that are already shipping. Straight off a week of intellectual synergy from the world-wide hackathon, we started to fix a lot of…

Metasploit Wrap-Up

Read up on how the recent community hackathon in Austin went, three new modules, and the usual long list of fixes and enhancements.…

Metasploit Wrap-Up

Unauthenticated scanner for BlueKeep, community hackathon in Austin, and the usual long list of fixes and enhancements.…

Metasploit Wrap-Up

BSD love Outside of macOS, not many people run (or run into) a BSD-flavored system very often. Even still, bcoles and space-r7 teamed up for a pair of BSD enhancements. The first, a privilege escalation, affects FreeBSD's runtime linker dealing with LD_PRELOAD in FreeBSD…

Metasploit Wrap-Up

Take a moment from this week's barrage of vulnerabilities in seemingly everything to see the cool stuff happening with the Metasploit team of contributors: a video interview between two greats, a new exploit module in GetSimple CMS, and a whole host of improvements.…

Metasploit Wrap-Up

A new Chrome browser exploit, some WebLogic RCE, and an exploit for PostgreSQL. Also announcing the return of our annual Open-Source Security Meetup in Vegas!…

Metasploit Wrap-Up

Better persistence options thanks to two new modules for Yum and APT package managers. Plus, new exploits for Rails DoubleTap and Spring Cloud Config.…

Metasploit Wrap-Up

Faster tab completion for `set PAYLOAD` and faster output for `show payloads`. Plus, four new exploits, including unauthenticated template injection for Atlassian Confluence and Ruby on Rails DoubleTap directory traversal.…

Metasploit Wrap-Up

A more useful use command From among the many musings of longtime contributor/team member Brent Cook, in a combined effort with the ever-present wvu, the use command has become so much more useful. PR 11724 takes new functionality from search -u one step further…

Metasploit Wrap-Up

WordPress RCE tiyeuse submitted a Metasploit module for an authenticated remote code execution vulnerability in WordPress, which was described in a blog post by RIPS Technology. After authenticating as a user with at least author privileges, the module starts by uploading an image file with…

Metasploit Wrap-Up

Your workflow just got easier Are you tired of copy/pasting module names from the search results before you can use them? Thanks to this enhancement (PR #11652) by Brent Cook, you can now run search with the -u flag to automatically use a module…

Metasploit Wrap-Up

Introducing Metasploit Development Diaries We are happy to introduce a new quarterly series, the Metasploit Development Diaries. The dev diaries walk users and developers through some example exploits and give detailed analysis of how the exploits operate and how Metasploit evaluates vulnerabilities for inclusion in…