Last updated at Fri, 10 Mar 2023 19:00:00 GMT
Wowza, a new credential gatherer and login scanner!
This week Metasploit Framework gained a credential gatherer for Wowza Streaming Engine Manager. Credentials for this application are stored in a file named
admin.password in a known location and the file is readable by default by
BUILTIN\Users on Windows and is world readable on Linux.. The module was written by community contributor bcoles who also wrote a login scanner for Wowza this week. The login scanner can be used to validate the credentials found by the gatherer. The two modules complement each other quite nicely.
New module content (3)
Wowza Streaming Engine Manager Login Utility
Pull request: #17733 contributed by bcoles
Description: This adds a login scanner module to brute force credentials of Wowza Streaming Engine Manager.
SugarCRM unauthenticated Remote Code Execution (RCE)
Authors: Sw33t.0day and h00die-gr3y
Pull request: #17507 contributed by h00die-gr3y
AttackerKB reference: CVE-2023-22952
Description: A module has been added which exploits CVE-2023-22952, a RCE vulnerability in SugarCRM 11.0 Enterprise, Professional, Sell, Serve, and Ultimate versions prior to 11.0.5 and SugarCRM 12.0 Enterprise, Sell, and Serve versions prior to 12.0.2. Successful exploitation as an unauthenticated attacker will result in remote code execution as the user running the web services, which is typically
Gather Wowza Streaming Engine Credentials
Pull request: #17737 contributed by bcoles
Description: This adds a post module that collects Wowza Streaming Engine user credentials from the
admin.password local configuration file. This file is world-readable by default on Linux and readable by
BUILTIN\Users on Windows.
Enhancements and features (9)
- #17675 from adfoster-r7 - Updates the
admin/kerberos/forge_ticketto support a new
extra_sidsoption which can be useful for including cross-domain SIDs for forging external Kerberos trust tickets as part of cross-trust domain escalation. The
admin/kerberos/inspect_tickethas also been updated to support viewing these extra SID values.
- #17686 from zeroSteiner - This adds 3 additional methods to the existing PetitPotam module to make it work even if the patch for CVE-2021-36942 has been installed. Note that it won't work after the December 2021 patch.
- #17715 from zeroSteiner - The Metasploit Payload gem has been bumped to 2.0.115, bringing in support for the
arpcommand to Python Meterpreter on Linux, and adding support for displaying IPv6 routing tables using the
routecommand on Windows.
- #17727 from rohitkumarankam - Two new options have been added to the login scanner library:
max_error_count. These options allow users to set the maximum number of errors that are allowed to occur when connecting as well as the maximum number of consecutive errors that are allowed when connecting before the login scanner will give up on a target.
- #17744 from adfoster-r7 - The code for
msfconsolehas been updated so that performance profiling can also take into account the time it takes to load
msfenvand console related libraries, thereby allowing for more accurate performance profiling.
- #17745 from gwillcox-r7 - This updates the metasploit-payloads gem to pull in changes to the Python Meterpreter on Windows to add the
route deletecommands as well as the ability to get process information such as process names and paths.
- #17746 from todb-r7 - The
data/wordlists/password.lstpassword list has been updated to include the master password that LastPass suggests as an example when a user goes to create a new master password,
r50$K28vaIFiYxaY, into the password list, as well as to fix some encoding issues.
- #17749 from adfoster-r7 - Updates the
auxiliary/admin/kerberos/keytab.rbmodule to additionally export any NTHASHES, which can be useful for decrypting Kerberos network traffic in Wireshark.
- #17756 from adfoster-r7 - Updates secrets dump to generate the Kerberos RC4 key for the machine account.
Bugs fixed (8)
- #17673 from bcoles -
lib/msf/core/payload/apk.rbhas been updated so that by default it only decompiles the main classes instead of all classes, fixing some issues whereby decompiling all classes would prevent creation of a backdoored APK. This also bumps up the minimum
apktoolversion to 2.4.1 and makes it so that versions prior to 2.7.0 of
apktoolwill throw a warning about being potentially out of date.
- #17716 from zeroSteiner - A bug has been fixed whereby the reverse port forward information message was displayed incorrectly, and the same information was shown on both the local and remote parts of the message.
- #17721 from zeroSteiner - This fixes an issue where payloads that were adapted failed when stage encoding was enabled because the stage encoding was based on the stager arch and platform values. These values were always the same until we introduced adapted payloads, which can vary.
- #17723 from jvoisin - A bug has been fixed in the
modules/encoders/php/base64.rbencoder whereby strings were being passed as literal strings without being properly quoted, which could result in errors on newer versions of PHP.
- #17726 from zeroSteiner - The Metasploit Payloads gem has been updated bringing in initial support for attaching to processes on Python Meterpreter shells on Windows, a bug fix for the
routecommand on newer versions of Windows on Windows Meterpreter, and a fix so that both C Meterpreter and Python Meterpreter sessions will attempt to enable the same set of permissions when running
- #17729 from bcoles - Fixes an edge case crash when running Ruby 3.2
- #17738 from adfoster-r7 - Fix Ruby 3.2 crash when running certain tools
- #17758 from zeroSteiner - The metasploit-payloads gem has been bumped to fix a token handle leak that was causing Python Meterpreters to leave dangling handles after using
getprivs, fix a error in
packet_transmit_httpwhereby error codes were not appropriately returned, and update the
arpcommand to properly return the interface name instead of the index for the
Documentation added (3)
- #17684 from adfoster-r7 - This PR adds the RBCD exploitation documentation to the docs site.
- #17688 from adfoster-r7 - This PR fixes several broken wiki links, as well as adding validation to users users don't use the wrong syntax when making docs changes.
- #17743 from adfoster-r7 - A new page has been added to explain the
METASPLOIT_MEMORY_PROFILEoptions and to explain how to profile
msfvenom's performance on systems.
You can always find more documentation on our docsite at docs.metasploit.com.
As always, you can update to the latest Metasploit Framework with
and you can get more details on the changes since the last blog post from
If you are a
git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).