Posts by William Vu

2 min Metasploit

Metasploit Wrap-Up: 6/12/20

Windows BITS CVE-2020-0787 LPE in the Metasploit tree! This week, Grant Willcox [] presents his first Metasploit module contribution [] as part of our team. Research [] from itm4n [] yielded CVE-2020-0787 [], describing a vulnerability in the Windows Background Intelligent Transfer Serv

3 min Metasploit Weekly Wrapup

Metasploit Wrap-Up: 2/21/20

Long live copy and paste Adam Galway enhanced the set PAYLOAD command to strip the /payload/, payload/, and / prefixes from a payload name in an effort to improve the user experience while configuring an exploit's payload. You can see the new behavior [] below! msf5 exploit(windows/smb/ms17_010_eternalblue) > set payload /payload/windows/x64/meterpreter/reverse_tcp payload => windows/x64/meterpreter/reverse_tcp msf5 exploit(windows/smb/ms

22 min Research


In this sequel, wvu [] recounts the R&D (in all its imperfect glory) behind creating a Metasploit module for the DOUBLEPULSAR implant's lesser-known RDP variant. If you're unfamiliar with the more common SMB variant, you can read our blog post [/2019/10/02/open-source-command-and-control-of-the-doublepulsar-implant/] detailing how we achieved RCE with it. Table of Contents 0. Background 1. Extracting the implant 2. Installing the implant 3. Pinging the implant 4.

3 min Metasploit Weekly Wrapup

Metasploit Wrap-Up 11/15/19

Pulse Secure VPN exploit modules, a notable BlueKeep exploit reliability improvement, and an overhaul of MSF's password cracking integration, including new support for hashcat.

20 min Research

Open-Source Command and Control of the DOUBLEPULSAR Implant

Metasploit researcher William Vu shares technical analysis behind a recent addition to Framework: a module that executes a Metasploit payload against the Equation Group's DOUBLEPULSAR implant for SMB and allows users to remotely disable the implant.

5 min Metasploit Weekly Wrapup

Metasploit Wrap-Up 8/16/19

Hacker Summer Camp Last week, the Metasploit team flew out to sunny, hot, and dry Las Vegas for Hacker Summer Camp (Black Hat, BSidesLV, and DEF CON). It was a full week of epic hacks, good conversation, and even a little business! If you managed to catch us at our Open Source Office Hours [] (previously OSSM, the Open Source Security Meetup) in Bally's, we just wanted to say thanks for making the trek through the

3 min Metasploit Weekly Wrapup

Metasploit Wrap-Up 2/15/19

Crock-Pot cooking with Metasploit Belkin's Wemo [] line of smart home devices offers users a variety of internet-connected gadgets and gizmos they can control around the home. One of those happens to be a Crock-Pot [] . We went ahead and bought one. Naturally, it made sense for us to write a module [

25 min Haxmas

The Ghost of Exploits Past: A Deep Dive into the Morris Worm

In this post, we will dive into the exploit development process for the three modules we created in honor of the 30th anniversary of the Morris worm.

3 min Metasploit Weekly Wrapup

Metasploit Wrapup: 7/13/18

Committing to some shells in GitList Shelby [] has been killing it with new exploit and aux modules by the day. In this iteration, she's produced an exploit [] for GitList 0.6.0 and likely older versions. The software is built on PHP and allows users to view a Git repo on the web. Through an argument injection, a fake pager [] can be executed... that is really our shell

3 min Release Notes

Weekly Metasploit Wrapup: March 14, 2016

Scanning for the Fortinet backdoor with Metasploit Written by wvu Metasploit now implements a scanner for the Fortinet backdoor. Curious to see how to use it? Check this out! wvu@kharak:~/metasploit-framework:master$ ./msfconsole -qL msf > use auxiliary/scanner/ssh/fortinet_backdoor msf auxiliary(fortinet_backdoor) > set rhosts 417.216.55.0/24 rhosts => 417.216.55.0/24 msf auxiliary(fortinet_backdoor) > set threads 100 threads => 100 msf auxiliary(fortinet_backdoor) > run [*]

1 min Metasploit

New "show missing" Command in msfconsole

Hello, Metasploiters! Just wanted to update y'all on a new feature in msfconsole that *hopefully* should make vgrepping [] through module options a little easier. Show empty required options The new command is show missing, and all it does is show empty required options. Instead of looking through a long list of options and picking out the required ones that haven't been set, just run show missing, and a list of unset required

5 min Metasploit

Making Your Printer Say "Feed Me a Kitten" and Also Exfiltrate Sensitive Data

As of this last release, PJL [] (HP's Printer Job Language) is now a grown-up Rex::Proto protocol! Since extending a protocol in Metasploit is beyond the scope of this post, we'll just be covering how to use the PoC modules included with the new protocol. Feel free to dig around in lib/rex/proto/pjl*, though! Okay, let's get started! printer_version_info First off, we have printer_version_info. This module lets us scan a range of hosts for pri