{"push_id":1445834881,"size":317,"distinct_size":257,"ref":"refs/heads/feature/aggregator","head":"43e313cdf08d0911db2f1924400f79079b35232e","before":"5ed030fcf6a55baa5093dcad2b1542bcebbb97aa","commits":[{"sha":"5bd43bf3d78ba87eb6e71cc8bcb1193da17729b4","author":{"name":"RageLtMan","email":"e290cab40d3b4ee1a972944de1ae32f37bb252ca"},"message":"Powershell WMI execution post module\n\nPowerhell provides direct interface to WMI, allowing users in UAC\nor otherwise restricted context to attain privileged resources via\nimpersonation. Moreover, WMI allows for execution remotely, on any\nendpoint attainable via DCOM. In practice, this allows foothold on\na single domain host to immediately infect every machine accessible\nvia DCOM either from the currently held privileged context (such as\na domain administrator) or from a new context generated by entering\nacquired credentials.\nPayloads, remote commands, and collection activities can be invoked\nwithout direct IP connectivity on a remote host, and output can\nbe collected the same way.\nOf particular note when implementing this technique is that admin\ncontexts resulting from this form of execution are not encapsulated\nin UAC, allowing for immediate privesc to system if creating a new\nsession.\nOld notes show that loopback exec is not stable or usable, though\nthis merits further research as it seems the native way to avoid\nUAC altogether without any exploitation.\nAs with all the other powershell vectors, this mechanism provides\nin-memory execution, and in all our testing walks right through the\nAV currently out there since it has no service executable, on-disk\nfootprint, or even error log from the improper service exit that\npsexec causes. Sandboxes dont cover powershell - too much runtime\nentropy and some quite legitimate use of sockets and unmanaged\nmemory marshalling to get a good \"guess\" of what the code is trying\nto do.\nMakes for a great gift left behind in GPO startup scripts or other\nlatent backdoor approaches. Since a script is produced, those with\nthe need and craft can alter the resulting scripts to dynamically\nenumerate domain hosts meeting their needs for exploitation at\nruntime, as opposed to the \"brute-force\" approach used here.\n\n-----\n\nTesting:\n  The internal module has been in use for over three years in our\nfork. Its been instrumental in showing several clients what it\nmeans to be \"pwned\" in 30s flat. This particular version has been\nslightly altered for upstream consumption and should be tested\nagain by community and developers alike in the upstream branch.\n\nNote:\n  Word to the wise on target selection - choose carefully, it is\npossible to generate more sessions than an L3 pivoted handler can\ncomfortably address, and having a thousand reverse_tcp sessions\ngoing past the edge is sure to raise an eyebrow at the SOC.","distinct":true,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/5bd43bf3d78ba87eb6e71cc8bcb1193da17729b4"},{"sha":"4a79e75af9ba639941b05c26543de92c938d7c17","author":{"name":"RageLtMan","email":"e290cab40d3b4ee1a972944de1ae32f37bb252ca"},"message":"Address void-in's comments\n\nDrop session type check\nCamel case advanced options\nClean up persistence, dry run, and error messages.\nClean up copyright/license clause.","distinct":true,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/4a79e75af9ba639941b05c26543de92c938d7c17"},{"sha":"6b2421e86152ff90a2e618a1eaab0c7fc01f1fd3","author":{"name":"RageLtMan","email":"e290cab40d3b4ee1a972944de1ae32f37bb252ca"},"message":"Use OJ's suggestion for fail_with","distinct":true,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/6b2421e86152ff90a2e618a1eaab0c7fc01f1fd3"},{"sha":"fce78dce44d96e461fba1a43cc5845e5fd88c216","author":{"name":"RageLtMan","email":"e290cab40d3b4ee1a972944de1ae32f37bb252ca"},"message":"Remove dependency on dot_net PR","distinct":true,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/fce78dce44d96e461fba1a43cc5845e5fd88c216"},{"sha":"1320647f31c8c68972aa5375a156d96e88235205","author":{"name":"Quentin Kaiser","email":"da9171a741aad169706770cb7bfddbe0626cff54@gmail.com"},"message":"Exploit for Trend Micro Smart Protection Server (CVE-2016-6267).","distinct":false,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/1320647f31c8c68972aa5375a156d96e88235205"},{"sha":"b935e3df2e102c5caf57289cb27d99a69b1f7f92","author":{"name":"Yorick Koster","email":"90adf7e458345867f0d39a8c91464c50659d2655@McPC.local"},"message":"Office OLE Multiple DLL Side Loading Vulnerabilities\n\nMultiple DLL side loading vulnerabilities were found in various COM\ncomponents.\nThese issues can be exploited by loading various these components as an\nembedded\nOLE object. When instantiating a vulnerable object Windows will try to\nload one\nor more DLLs from the current working directory. If an attacker\nconvinces the\nvictim to open a specially crafted (Office) document from a directory\nalso\ncontaining the attacker's DLL file, it is possible to execute arbitrary\ncode with\nthe privileges of the target user. This can potentially result in the\nattacker\ntaking complete control of the affected system.","distinct":false,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/b935e3df2e102c5caf57289cb27d99a69b1f7f92"},{"sha":"22054ce85c65e45e44cb1153c63114c5318051ce","author":{"name":"Yorick Koster","email":"f7533301638184f5f8bb8d47d2704b507cc1e094@users.noreply.github.com"},"message":"Fixed build errors","distinct":false,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/22054ce85c65e45e44cb1153c63114c5318051ce"},{"sha":"b7049939d9f299683a23eb73dca235c738445175","author":{"name":"Yorick Koster","email":"f7533301638184f5f8bb8d47d2704b507cc1e094@users.noreply.github.com"},"message":"Fixed more build errors","distinct":false,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/b7049939d9f299683a23eb73dca235c738445175"},{"sha":"3ed7908b836888a348e1854f7bc45282eca2c66d","author":{"name":"Yorick Koster","email":"90adf7e458345867f0d39a8c91464c50659d2655@McPC.local"},"message":"Internet Explorer iframe sandbox local file name disclosure vulnerability\n\nIt was found that Internet Explorer allows the disclosure of local file\nnames. This issue exists due to the fact that Internet Explorer behaves\ndifferent for file:// URLs pointing to existing and non-existent files.\nWhen used in combination with HTML5 sandbox iframes it is possible to\nuse this behavior to find out if a local file exists. This technique\nonly works on Internet Explorer 10 & 11 since these support the HTML5\nsandbox. Also it is not possible to do this from a regular website as\nfile:// URLs are blocked all together. The attack must be performed\nlocally (works with Internet zone Mark of the Web) or from a share.","distinct":false,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/3ed7908b836888a348e1854f7bc45282eca2c66d"},{"sha":"0fcced20913d7b36850db92e7ad0dc14bfe0a9c3","author":{"name":"Yorick Koster","email":"90adf7e458345867f0d39a8c91464c50659d2655@McPC.local"},"message":"Revert \"Internet Explorer iframe sandbox local file name disclosure vulnerability\"\n\nThis reverts commit 3ed7908b836888a348e1854f7bc45282eca2c66d.","distinct":false,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/0fcced20913d7b36850db92e7ad0dc14bfe0a9c3"},{"sha":"39407dda95440c351693bc92c56d6a337e535815","author":{"name":"Danil Bazin","email":"0b170e591c79899158d7cbe5dae0b0399cd5fd60@gmail.com"},"message":"Winpmem meterpreter extension","distinct":true,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/39407dda95440c351693bc92c56d6a337e535815"},{"sha":"bfabb3877c014d9670717a2da865cef0e00de480","author":{"name":"Danil Bazin","email":"0b170e591c79899158d7cbe5dae0b0399cd5fd60@gmail.com"},"message":"@void-in suggestions styles","distinct":true,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/bfabb3877c014d9670717a2da865cef0e00de480"},{"sha":"4d3611ceb9ec10656ee8821d536786b1dc51d3fe","author":{"name":"Jan Mitchell","email":"1437bf46e70ea383e7ee18630f7a7805cc362ec5@contextis.co.uk"},"message":"Added MIPSBE support to Samba exploit. Added a MIPSBE nop generator","distinct":true,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/4d3611ceb9ec10656ee8821d536786b1dc51d3fe"},{"sha":"411689aa444fb098b0047be08c40b27fcbc84ff7","author":{"name":"Jan Mitchell","email":"1437bf46e70ea383e7ee18630f7a7805cc362ec5@contextis.co.uk"},"message":"Adding changes to Samba exploit to target MIPSBE (this is for OpenWRT on a router","distinct":true,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/411689aa444fb098b0047be08c40b27fcbc84ff7"},{"sha":"e4d118108ade16ec0be1c2000a198487418fed0d","author":{"name":"Quentin Kaiser","email":"da9171a741aad169706770cb7bfddbe0626cff54@gmail.com"},"message":"Trend Micro SafeSync exploit.","distinct":false,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/e4d118108ade16ec0be1c2000a198487418fed0d"},{"sha":"7393d91bfa88aaca2dc0ce08d3ddf2f21be0a657","author":{"name":"Jan Mitchell","email":"1437bf46e70ea383e7ee18630f7a7805cc362ec5@contextis.co.uk"},"message":"Merge branch 'master' of https://github.com/rapid7/metasploit-framework into upstream-master","distinct":true,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/7393d91bfa88aaca2dc0ce08d3ddf2f21be0a657"},{"sha":"c102384b7a789b165a8aa657c2af620dbdf6f823","author":{"name":"Jan Mitchell","email":"1437bf46e70ea383e7ee18630f7a7805cc362ec5@contextis.co.uk"},"message":"Remove spaces at EOL","distinct":true,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/c102384b7a789b165a8aa657c2af620dbdf6f823"},{"sha":"c036c258a90d58c0fc1dfdec31c436ae41f42686","author":{"name":"h00die","email":"b7b3f71fa30f67c02489b96a9b07cc5180152b71@gmail.com"},"message":"cve-2016-4557","distinct":false,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/c036c258a90d58c0fc1dfdec31c436ae41f42686"},{"sha":"4fac5271ae8052ca8a642be376f9720370cfba3b","author":{"name":"h00die","email":"b7b3f71fa30f67c02489b96a9b07cc5180152b71@gmail.com"},"message":"slight cleanup","distinct":false,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/4fac5271ae8052ca8a642be376f9720370cfba3b"},{"sha":"bac4a25b2ca6570ae8671d4c22c643fa0559cf7c","author":{"name":"h00die","email":"b7b3f71fa30f67c02489b96a9b07cc5180152b71@gmail.com"},"message":"compile or nill","distinct":false,"url":"https://api.github.com/repos/jmartin-r7/metasploit-framework/commits/bac4a25b2ca6570ae8671d4c22c643fa0559cf7c"}]}
{"actor":{"display_login":"jmartin-r7"}}