Posts by Erin Bleiweiss

3 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

Three new modules that deliver RCE on Atlassian Crowd and privilege escalation to SYSTEM via print drivers. Plus, a new command shell session type for SSH clients and plenty more enhancements and fixes.

3 min Metasploit

Metasploit Wrap-Up

New modules that include Active Directory, Chrome, and Micro Focus targets. And we also reached-and-passed our 15,000th PR!!

2 min Metasploit

Metasploit Wrap-Up

Setting module options just got easier! Rapid7's own Dean Welch [https://github.com/dwelch-r7] added a new option [https://github.com/rapid7/metasploit-framework/pull/13961] to framework called RHOST_HTTP_URL, which allows users to set values for multiple URL components, such as RHOSTS, RPORT, and SSL, by specifying a single option value. For example, instead of typing set RHOSTS example.com, set RPORT 5678, set SSL true, you can now accomplish the same thing with the command set RHOST_HTTP_URL

2 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

Three new modules, including a post module to automate the installation of an embeddable Python interpreter on a target, and a new exploit for Microsoft SharePoint Workflows.

2 min Metasploit

Metasploit Wrap-up

Exploiting Windows tools There are two new Windows modules this week, both brought to you by the Metasploit team. The Windows Silent Process Exit Persistence module [https://github.com/rapid7/metasploit-framework/pull/12375], from our own bwatters-r7 [https://github.com/bwatters-r7], exploits a Windows tool that allows for debugging a specified process on exit. With escalated privileges, an attacker can configure the debug process and then use the module to upload a payload which will launch e

2 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

We hope our American friends had a wonderful Fourth of July weekend! There are no new modules this week, so instead we're featuring two enhancements that fix some long outstanding Framework bugs. Check out last week’s holiday wrap-up [/2019/07/05/metasploit-wrap-up-24/] for a list of the modules that landed while the U.S. was watching fireworks. GatherProof (or don't) Using ssh_login* on certain non-standard devices such as Brocade switches [https://github.com/rapid7/metasploit-framework/issues

2 min Metasploit

Metasploit Wrap-Up

Your workflow just got easier Are you tired of copy/pasting module names from the search results before you can use them? Thanks to this enhancement (PR #11652) [https://github.com/rapid7/metasploit-framework/pull/11652] by Brent Cook [https://github.com/busterb], you can now run search with the -u flag to automatically use a module if there is only one result. Now you're one step closer to popping a shell! A pair of new JSO modules Metasploit published research a few weeks ago on Java Serializ

2 min Metasploit Weekly Wrapup

Metasploit Wrap-up

Happy New Year to the Metasploit community! As we kick off 2019, we're excited to see all the modules, enhancements, and discussions the new year will bring. Ring In 2019 With SSL There is a new datastore option [https://github.com/rapid7/metasploit-framework/pull/11160] courtesy of wvu [https://github.com/wvu-r7] called CMDSTAGER::SSL. This exposes the ability to enable SSL/TLS command stagers with set cmdstager::ssl true. Auld Erlang Syne Good news if you're a fan of the multi/misc/erlang_co

2 min Metasploit Weekly Wrapup

Metasploit Wrapup

Trevor Forget: Metasploit Town Hall @ Derbycon Metasploit’s Brent Cook [/author/brent-cook], Adam Cammack [/author/adam-cammack], Aaron Soto [/author/aaron], and Cody Pierce are offering themselves up to the crowds at this year’s fourth annual Metasploit Town Hall at Derbycon [https://www.derbycon.com/]. Heading to bourbon country next weekend? Block off your 5 PM hour on Saturday, October 6 to join the team as they unveil some new hotness in Metasploit Framework and take questions and requests