Last updated at Thu, 08 Feb 2024 21:58:25 GMT

Would you like to help Metasploit Framework and get a free t-shirt?

There is still a bit of October left, which means you can totally still sign up for Hacktoberfest: a fun annual project to encourage open source software contributions! Make four pull requests on any open source GitHub project by Oct 31, and you might find yourself some joy and fulfilment—but at least a free t-shirt.

Check out the Contribute section on the refreshed metasploit.com to see some ways you can help the Metasploit Framework project—or get right to stacking up those pull requests by fixing some current open bugs!

What's new?

Fixes

Several network scanner modules are being updated to work through proxies. The Nessus REST scanner and POP3 login scanner are now working. Issues in the Metasploit FTP client were also addressed, including improving downloads of larger files and avoiding crashes over time from open file descriptors. And metasploit-aggregator now once again has Cryptlv support.

Exploit modules (4 new)

Jack in...to GOPHERSPACE!

You might think that the Gopher protocol is long gone—nope nope nope! The fun predecessor of the HTTP-flavored WWW is still kicking. Additional good news: you can browse Gopher sites with most fun-loving browsers! Here’s a page with lots of info to continue your journey, including a list of the ~150 Gopher sites still serving out there, such as MetaFilter’s Gopher server (resurrected in 2016).

Thanks to h00die’s new aux module, you can now use Metasploit to scan for Gopher servers and then, should you stumble on such a coelacanth treasure, process their gophermap (that’s what the cool kids called the file listing all files on the Gopher server). Here’s the module source code and handy module documentation. Go for it!

What’s cooking?

Aside from working to make TLS certs generated in Metasploit more realistic (and less likely to be rejected), we’re getting close on the Socks5Proxy. After wrapping up improvements around automatic RPC requests, we hope have this available in the new week or two!

Mettle development also continues with

  • Broader support: updating to run on embedded powerPC (enterprise printers, anyone?)
  • More options: via new extension loader for all POSIX payloads (we talked about that some in last week’s wrapup; it should be available in next 1-2 weeks!)
  • Smaller file sizes: staged payload now as small as stageless (both down to 700k)

Get it

As always, you can update to the latest Metasploit Framework by simply updating to the latest version provided by BlackArch Linux, Kali Linux, Metasploit Pro, or by using the handy msfupdate command available in the Nightly Installers.

You can get more details on the changes since the last wrapup here at:

To install fresh, you can use the: