4 min
Python
Virtual Machine Automation (vm-automation) repository released
Rapid7 just released a new public repo called vm-automation. The vm-automation
repository is a Python library that encapsulates existing methodologies for
virtual machine and hypervisor automation and provides a platform-agnostic
Python API. Currently, only ESXi and VMWare workstation are supported, but I
have high hopes we will support other hypervisors in time, and we would love to
see contributors come forward and assist in supporting them!
That's awesome. I want to get started now!
Great! I
3 min
Metasploit Weekly Wrapup
Metasploit Wrapup: June 30, 2017
Metasploit Hackathon
We were happy to host the very first Metasploit framework open source hackathon
this past week in the Rapid7 Austin. Eight Metasploit hackers from outside of
Rapid7 joined forces with the in-house team and worked on a lot of great
projects, small and large.
@bcook started the hackathon working with @sempervictus on his amazing backlog
of framework features, including REX library
[https://github.com/rapid7/rex-socket/pull/6] improvements
[https://github.com/rapid7/rex-socket
2 min
Metasploit
Metasploit Wrapup: June 16, 2017
A fresh, new UAC bypass module for Windows 10!
Leveraging the behavior of fodhelper.exe and a writable registry key as a normal
user, you too can be admin! Unpatched as of last week, this bypass module
[https://github.com/rapid7/metasploit-framework/pull/8434] works on Windows 10
only, but it works like a charm!
Reach out and allocate something
This release offers up a fresh denial/degradation of services exploit against
hosts running a vulnerable version of rpcbind. Specifically, you can repea
2 min
Metasploit
Metasploit Wrapup 6/2/17
It has only been one week since the last wrapup, so it's not like much could
have happened, right? Wrong!
Misery Loves Company
After last week's excitement with Metasploit's version of ETERNALBLUE (AKA the
Wannacry vulnerability)
[https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue],
this week SAMBA had its own "Hold My Beer" moment with the disclosure that an
authenticated (or anonymous) client can upload a shared library to a SAMBA
server, and that server will happily e