2 min
Metasploit
Metasploit Weekly Wrap-Up: 6/10/22
A Confluence of High-Profile Modules
This release features modules covering the Confluence remote code execution bug
CVE-2022-26134 and the hotly-debated CVE-2022-30190, a file format vulnerability
in the Windows Operating System accessible through malicious documents. Both
have been all over the news, and we’re very happy to bring them to you so that
you can verify mitigations and patches in your infrastructure. If you’d like to
read more about these vulnerabilities, Rapid7 has AttackerKB analy
2 min
Metasploit
Metasploit Weekly Wrap-Up: 1/21/22
while (j==shell); Log4j;
The Log4j loop continues as we release a module targeting vulnerable vCenter
releases. This is a good time to suggest that you check your vCenter releases
and maybe even increase the protection surrounding them, as it’s been a rough
year-plus for vCenter
[https://attackerkb.com/search?q=vcenter&tags=exploitedInTheWild].
Let your shell do the walking
bcoles [https://github.com/bcoles] sent us a module that targets Grandstream
GXV3175IP phones that allows remote code exec
2 min
Metasploit Weekly Wrapup
Metasploit Wrap-Up 10/15/21
Four new Moodle modules, plus new features to help red teamers keep track of sessions and forwarded connections.
2 min
Metasploit Weekly Wrapup
Metasploit Wrap-Up: 9/17/21
New modules for Jira user enumeration, Git Remote Code execution via git-lfs, Geutebruck Camera post exploitation module, and unauthenticated RCE in elFinder PHP application
2 min
Metasploit
Metasploit Wrap-Up: 7/2/21
Containers that fail to Contain
Our own Christophe De La Fuente added a module for CVE-2019-5736 based on the
work of Adam Iwaniuk that breaks out of a Docker container by overwriting the
runc binary of an image which is run in the user context whenever someone
outside the container runs docker exec to make a request of the container.
Execute an Image Please, Wordpress
Community contributor Alexandre Zanni sent us a PR that uses native PHP
functions to upload a file as an image attachment to Wo
3 min
Metasploit Weekly Wrapup
Metasploit Wrap-Up 4/2/21
Six new modules targeting F5, SaltStack, Exchange Server, and more, plus some significant performance improvements and fixes.
2 min
Metasploit Weekly Wrapup
Metasploit Wrap-Up: 12/4/20
It's CTF week(end)! Plus, steal files from Apache Tomcat servers thanks to a new Ghostcat exploit, and dump process memory with a new post module that leverages Avast AV's built-in AvDump utility.
3 min
Metasploit Weekly Wrapup
Metasploit Wrap-up: 9/25/20
Nine new modules, including a module for Zerologon, a new SOCKS module, some privilege escalations, and another Java deserialization exploit.
2 min
Metasploit Weekly Wrapup
Metasploit Wrap-Up: 5/29/20
Hello, World!
This week’s wrapup features six new modules, including a double-dose of Synology
and everyone’s favorite, Pi-Hole.
Little NAS, featuring RCE
Synology stations are small(ish) NAS devices, but as Steve Kaun, Nigusu
Kassahun, and h00die have shown, they are not invulnerable. In the first module,
a command injection exists in a scanning function that allows for an
authenticated RCE, and in the second, a coding feature leaks whether a user
exists on the system, allowing for brute-forc
2 min
Metasploit
Metasploit Wrap-Up: Feb. 7, 2020
In the week after our CTF, we hope the players had a good time and got back to
their loved ones, jobs, lives, studies, and most importantly, back to their beds
(and you can find out who the winners were here
[/2020/02/03/congrats-to-the-winners-of-the-2020-metasploit-community-ctf/]!).
For the Metasploit team, we went back to baking up fresh, hot modules and
improvements that remind us in this flu season to not just wash your hands, but
also, sanitize your inputs!
SOHOwabout a Shell?
Several
[h
2 min
Metasploit
Metasploit Wrap-Up: 12/19/19
It’s beginning to look a lot like HaXmas [/tag/haxmas/], everywhere you go! We
have a great selection of gift-wrapped modules this holiday season, sure to have
you entertained from one to eight nights, depending on your preference! On a
personal note, we here at the Metasploit workshop would like to welcome our
newest elf, Spencer McIntyre [https://github.com/smcintyre-r7]. Spencer has been
a long-time contributor to the project, and we’re thrilled to have him on the
team!
In the spirit of givi
3 min
Metasploit Weekly Wrapup
Metasploit Wrap-Up: Sep. 13, 2019
Fall is in the air, October is on the way, and it is Friday the 13th. We have a
lot of updates and features that landed this week, though none are particularly
spooky, and unfortunately, none are json-related…1
We recently updated our digital signing keys, and some users may have seen
warnings that their Metasploit packages were not signed. We’ve fixed this as of
this week—apologies for any confusion. If you are still experiencing signing
issues, you may need to re-download Metasploit installer
5 min
Metasploit
Introducing Pingback Payloads
The Metasploit team added a new feature to Framework that improves safety and offers another avenue in MSF for novel evasion techniques: pingback payloads.
2 min
Metasploit Weekly Wrapup
Metasploit Wrap-Up 6/14/19
It’s Summertime, and the Hackin’ is Easy
It is still early in the season, but there’s a whole lot of fixes that are
already shipping. Straight off a week of intellectual synergy from the
world-wide hackathon, we started to fix a lot of things we noticed while we
coded over street tacos and Austin-famous beverages. All told, this week we made
Metasploit more inclusive, transparent, and configurable!
Inclusive
@wvu-r7 has been on a roll trying to make Metasploit play well with others. He
teamed u
2 min
Metasploit Weekly Wrapup
Metasploit Wrap-Up: Mar. 22, 2019
Spring is here: Four new modules and metashell improvements.