Posts tagged Metasploit

3 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

New modules for Jira user enumeration, Git Remote Code execution via git-lfs, Geutebruck Camera post exploitation module, and unauthenticated RCE in elFinder PHP application

3 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

Confluence Server OGNL Injection Our own wvu [https://github.com/wvu-r7] along with Jang [https://twitter.com/testanull] added a module that exploits an OGNL injection ( CVE-2021-26804 [https://attackerkb.com/topics/Eu74wdMbEL/cve-2021-26084-confluence-server-ognl-injection] )in Atlassian Confluence's WebWork component to execute commands as the Tomcat user. CVE-2021-26804 is a critical remote code execution vulnerability in Confluence Server and Confluence Data Center and is actively being expl

5 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

A new SMB server implementation to support capturing NTLM hashes across SMBv2 and SMBv3, even with encrypted SMB traffic. Plus, exploits for eBPF, Git LFS, and Geutebruck IP cameras.

2 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

LearnPress authenticated SQL injection Metasploit contributor h00die [https://github.com/h00die] added a new module that exploits CVE-2020-6010 [https://attackerkb.com/topics/x12K9JOfk2/cve-2020-6010?referrer=blog], an authenticated SQL injection vulnerability in the WordPress LearnPress plugin. When a user is logged in with contributor privileges or higher, the id parameter can be used to inject arbitrary code through an SQL query. This exploit can be used to collect usernames and password hash

2 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

New modules for Lucee Administrator and ProxyShell, which targets on-premises Microsoft Exchange servers. Plus, tons of enhancements and fixes!

3 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

Three new modules that deliver RCE on Atlassian Crowd and privilege escalation to SYSTEM via print drivers. Plus, a new command shell session type for SSH clients and plenty more enhancements and fixes.

2 min Metasploit

Metasploit Wrap-Up

Desert heat (not the 1999 film) This week was more quiet than normal with Black Hat USA and DEF CON, but that didn’t stop the team from delivering some small enhancements and bug fixes! We are also excited to see two new modules #15519 [https://github.com/rapid7/metasploit-framework/pull/15519] and #15520 [https://github.com/rapid7/metasploit-framework/pull/15520] from researcher Jacob Baines’ [https://twitter.com/Junior_Baines] DEF CON talk ​​Bring Your Own Print Driver Vulnerability [https://

3 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

Five new modules, including an exploit for "HiveNightmare" CVE-2021-36934, and new fixes and enhancements.

4 min Metasploit

Metasploit Wrap-Up

Now I Control Your Resource Planning Servers Sage X3 is a resource planning product designed by Sage Group which is designed to help established businesses plan out their business operations. But what if you wanted to do more than just manage resources? What if you wanted to hijack the resource server itself? Well wait no more, as thanks to the work of Aaron Herndon [https://www.linkedin.com/in/aaron-herndon-54079b5a/], Jonathan Peterson [https://www.linkedin.com/in/jonathan-p-004b76a1/], Will

3 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

Four new modules, with improvements to Eternal Blue support, and AmSi 0BfuSc@t!on for Powershell payloads

2 min Metasploit

Metasploit Wrap-up

A new module for CVE-2021-34527, dubbed PrintNightmare, and a local privilege escalation module for NSClient++

2 min Metasploit

Metasploit Wrap-Up

Containers that fail to Contain Our own Christophe De La Fuente added a module for CVE-2019-5736 based on the work of Adam Iwaniuk that breaks out of a Docker container by overwriting the runc binary of an image which is run in the user context whenever someone outside the container runs docker exec to make a request of the container. Execute an Image Please, Wordpress Community contributor Alexandre Zanni sent us a PR that uses native PHP functions to upload a file as an image attachment to Wo

3 min Metasploit Weekly Wrapup

Metasploit Wrap-Up

Three fresh modules for Cisco targets and rConfig, plus new enhancements and fixes.

3 min Metasploit

Metasploit Wrap-Up

New Emby version scanner, IPFire authenticated RCE, HashiCorp Nomad RCE, Microsoft SharePoint unsafe control and ViewState RCE.

3 min Metasploit

Metasploit Wrap-Up

NSClient++ Community contributor Yann Castel has contributed an exploit module for NSClient++ which targets an authenticated command execution vulnerability. Users that are able to authenticate to the service as admin can leverage the external scripts feature to execute commands with SYSTEM level privileges. This allows the underlying server to be compromised. Castel is also working on another exploit module for NSClient++ which happens to be a local privilege escalation so stay tuned for more N