Skip to content

Commit 24877f8

Browse files
author
certcc-ghbot
committed
Merge remote-tracking branch 'upstream/master'
2 parents 2699310 + 839fc52 commit 24877f8

23 files changed

Lines changed: 857 additions & 438 deletions

File tree

‎db/modules_metadata_base.json‎

Lines changed: 88 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -9585,7 +9585,7 @@
95859585
"autofilter_ports": [],
95869586
"autofilter_services": [],
95879587
"targets": null,
9588-
"mod_time": "2025-06-23 09:30:35 +0000",
9588+
"mod_time": "2026-03-31 12:39:21 +0000",
95899589
"path": "/modules/auxiliary/admin/oracle/oraenum.rb",
95909590
"is_install_path": true,
95919591
"ref_name": "admin/oracle/oraenum",
@@ -10668,7 +10668,7 @@
1066810668
"ftp"
1066910669
],
1067010670
"targets": null,
10671-
"mod_time": "2025-05-26 20:49:19 +0000",
10671+
"mod_time": "2026-03-31 12:39:21 +0000",
1067210672
"path": "/modules/auxiliary/admin/scada/modicon_password_recovery.rb",
1067310673
"is_install_path": true,
1067410674
"ref_name": "admin/scada/modicon_password_recovery",
@@ -49520,7 +49520,7 @@
4952049520
"autofilter_ports": [],
4952149521
"autofilter_services": [],
4952249522
"targets": null,
49523-
"mod_time": "2025-06-20 13:20:44 +0000",
49523+
"mod_time": "2026-03-31 12:39:21 +0000",
4952449524
"path": "/modules/auxiliary/scanner/misc/ib_service_mgr_info.rb",
4952549525
"is_install_path": true,
4952649526
"ref_name": "scanner/misc/ib_service_mgr_info",
@@ -51784,7 +51784,7 @@
5178451784
"https"
5178551785
],
5178651786
"targets": null,
51787-
"mod_time": "2026-03-31 11:35:34 +0000",
51787+
"mod_time": "2026-03-31 14:32:46 +0000",
5178851788
"path": "/modules/auxiliary/scanner/oracle/isqlplus_sidbrute.rb",
5178951789
"is_install_path": true,
5179051790
"ref_name": "scanner/oracle/isqlplus_sidbrute",
@@ -109142,6 +109142,86 @@
109142109142
"session_types": false,
109143109143
"needs_cleanup": null
109144109144
},
109145+
"exploit_multi/http/freescout_htaccess_rce": {
109146+
"name": "FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass",
109147+
"fullname": "exploit/multi/http/freescout_htaccess_rce",
109148+
"aliases": [],
109149+
"rank": 600,
109150+
"disclosure_date": "2026-03-01",
109151+
"type": "exploit",
109152+
"author": [
109153+
"offensiveee",
109154+
"Nir Zadok (nirzadokox) <OX Security>",
109155+
"Moses Bhardwaj (MosesOX) <OX Security>",
109156+
"Valentin Lobstein <chocapikk@leakix.net>"
109157+
],
109158+
"description": "This module exploits an unauthenticated remote code execution vulnerability\n in FreeScout <= 1.8.206 (CVE-2026-28289). The sanitizeUploadedFileName()\n function checks for dot-prefixed filenames before stripping Unicode format\n characters (ZWSP U+200B), allowing .htaccess upload via email attachment.\n\n A crafted email is sent via SMTP to a FreeScout mailbox. When fetched by\n the IMAP/POP3 cron (typically every 60s), the ZWSP is stripped and the\n attachment is stored as .htaccess. The file uses SetHandler to make itself\n executable as PHP, achieving code execution when requested via HTTP.\n\n Requires a valid mailbox email address and web-accessible attachment\n storage (storage:link pointing to storage/app/).",
109159+
"references": [
109160+
"CVE-2026-28289",
109161+
"CVE-2026-27636",
109162+
"GHSA-5gpc-65p8-ffwp",
109163+
"GHSA-mw88-x7j3-74vc",
109164+
"URL-https://www.ox.security/blog/freescout-rce-cve-2026-28289/",
109165+
"URL-https://www.ox.security/blog/freescout-rce-cve-2026-27636/"
109166+
],
109167+
"platform": "Linux,PHP,Unix,Windows",
109168+
"arch": "php, cmd, x86, x64",
109169+
"rport": 25,
109170+
"autofilter_ports": [
109171+
80,
109172+
8080,
109173+
443,
109174+
8000,
109175+
8888,
109176+
8880,
109177+
8008,
109178+
3000,
109179+
8443,
109180+
25,
109181+
465,
109182+
587,
109183+
2525,
109184+
25025,
109185+
25000
109186+
],
109187+
"autofilter_services": [
109188+
"http",
109189+
"https",
109190+
"smtp",
109191+
"smtps"
109192+
],
109193+
"targets": [
109194+
"PHP In-Memory",
109195+
"Unix/Linux Command Shell",
109196+
"Linux Dropper",
109197+
"Windows Command Shell",
109198+
"Windows Dropper"
109199+
],
109200+
"mod_time": "2026-03-27 19:30:47 +0000",
109201+
"path": "/modules/exploits/multi/http/freescout_htaccess_rce.rb",
109202+
"is_install_path": true,
109203+
"ref_name": "multi/http/freescout_htaccess_rce",
109204+
"check": true,
109205+
"post_auth": false,
109206+
"default_credential": false,
109207+
"notes": {
109208+
"AKA": [
109209+
"Mail2Shell"
109210+
],
109211+
"Stability": [
109212+
"crash-safe"
109213+
],
109214+
"Reliability": [
109215+
"repeatable-session"
109216+
],
109217+
"SideEffects": [
109218+
"ioc-in-logs",
109219+
"artifacts-on-disk"
109220+
]
109221+
},
109222+
"session_types": false,
109223+
"needs_cleanup": null
109224+
},
109145109225
"exploit_multi/http/gambio_unauth_rce_cve_2024_23759": {
109146109226
"name": "Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability",
109147109227
"fullname": "exploit/multi/http/gambio_unauth_rce_cve_2024_23759",
@@ -194493,51 +194573,6 @@
194493194573
"needs_cleanup": null,
194494194574
"actions": []
194495194575
},
194496-
"exploit_windows/local/persistence": {
194497-
"name": "Windows Persistent Registry Startup Payload Installer",
194498-
"fullname": "exploit/windows/local/persistence",
194499-
"aliases": [],
194500-
"rank": 600,
194501-
"disclosure_date": "2011-10-19",
194502-
"type": "exploit",
194503-
"author": [
194504-
"Carlos Perez <carlos_perez@darkoperator.com>",
194505-
"g0tmi1k"
194506-
],
194507-
"description": "This module will install a payload that is executed during boot.\n It will be executed either at user logon or system startup via the registry\n value in \"CurrentVersion\\Run\" (depending on privilege and selected method).",
194508-
"references": [],
194509-
"platform": "Windows",
194510-
"arch": "",
194511-
"rport": null,
194512-
"autofilter_ports": [],
194513-
"autofilter_services": [],
194514-
"targets": [
194515-
"Windows"
194516-
],
194517-
"mod_time": "2025-06-23 12:43:46 +0000",
194518-
"path": "/modules/exploits/windows/local/persistence.rb",
194519-
"is_install_path": true,
194520-
"ref_name": "windows/local/persistence",
194521-
"check": false,
194522-
"post_auth": false,
194523-
"default_credential": false,
194524-
"notes": {
194525-
"Reliability": [
194526-
"unknown-reliability"
194527-
],
194528-
"Stability": [
194529-
"unknown-stability"
194530-
],
194531-
"SideEffects": [
194532-
"unknown-side-effects"
194533-
]
194534-
},
194535-
"session_types": [
194536-
"meterpreter"
194537-
],
194538-
"needs_cleanup": null,
194539-
"actions": []
194540-
},
194541194576
"exploit_windows/local/plantronics_hub_spokesupdateservice_privesc": {
194542194577
"name": "Plantronics Hub SpokesUpdateService Privilege Escalation",
194543194578
"fullname": "exploit/windows/local/plantronics_hub_spokesupdateservice_privesc",
@@ -203694,7 +203729,8 @@
203694203729
"name": "Windows Registry Only Persistence",
203695203730
"fullname": "exploit/windows/persistence/registry",
203696203731
"aliases": [
203697-
"exploits/windows/local/registry_persistence"
203732+
"exploits/windows/local/registry_persistence",
203733+
"exploits/windows/local/persistence"
203698203734
],
203699203735
"rank": 600,
203700203736
"disclosure_date": "2015-07-01",
@@ -203719,7 +203755,7 @@
203719203755
"targets": [
203720203756
"Automatic"
203721203757
],
203722-
"mod_time": "2026-01-08 21:00:39 +0000",
203758+
"mod_time": "2026-02-21 09:15:56 +0000",
203723203759
"path": "/modules/exploits/windows/persistence/registry.rb",
203724203760
"is_install_path": true,
203725203761
"ref_name": "windows/persistence/registry",
@@ -282290,7 +282326,7 @@
282290282326
"autofilter_ports": null,
282291282327
"autofilter_services": null,
282292282328
"targets": null,
282293-
"mod_time": "2025-09-08 17:30:59 +0000",
282329+
"mod_time": "2026-03-31 12:39:21 +0000",
282294282330
"path": "/modules/post/windows/gather/credentials/credential_collector.rb",
282295282331
"is_install_path": true,
282296282332
"ref_name": "windows/gather/credentials/credential_collector",

‎docs/metasploit-framework.wiki/Pivoting-in-Metasploit.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -444,7 +444,7 @@ Now edit the `proxychains` configuration file located at `/etc/proxychains.conf`
444444
socks5 127.0.0.1 1080
445445
```
446446

447-
The final final should look something like this:
447+
The final file should look something like this:
448448

449449
```ini
450450
# proxychains.conf VER 3.1
@@ -567,7 +567,7 @@ index.html 100%[===========================>] 57.34K --.-KB/s i
567567
```
568568

569569
### Scanning
570-
For scanning with Nmap, Zenmap, Nessus and others, keep in mind that ICMP and UPD traffic cannot tunnel through the proxy. So you cannot perform ping or UDP scans.
570+
For scanning with Nmap, Zenmap, Nessus and others, keep in mind that ICMP and UDP traffic cannot tunnel through the proxy. So you cannot perform ping or UDP scans.
571571

572572
For Nmap and Zenmap, the below example shows the commands can be used. It is best to be selective on ports to scan since scanning through the proxy tunnel can be slow.
573573

0 commit comments

Comments
 (0)