Last updated at Tue, 16 Jan 2024 01:57:55 GMT

You may have noticed that our weekly wrapups tend to be very light-hearted. A few might say our blog is humourous. Some might even argue that they incorporate low-brow internet jokes and an excessive quantity of memes.

Well, I'm here to say we've turned over a new leaf. No longer will cheap comedy cover the pages of this professional publication.

In honor of April 20th, this blog post will remain serious.

Seriously.

Google Summer of Code finalists, stay tuned!

Serious work is happening this summer, thanks in part to the community submissions we received to the Google Summer of Code program.

Now, we're gearing up for Google's acceptance announcements on Monday, April 23rd! We're eager to bring your ideas to life and invite you to watch your inbox Monday for details.

Serious APFS encryption password disclosure

Apple has been having a seriously hard time with Apple File System encryption lately. Last year, they accidentally copied the plaintext password into the hint field, and a few weeks ago, the community realized that APFS encryption plaintext passwords were being leaked via local log files.

The post/osx/gather/apfs_encrypted_volume_passwd module takes advantage of this vulnerability to exfiltrate the APFS volume encryption password.

Stay tuned for next week, when Twitter discovers what happens when you ask Siri: "What's my iCloud password?"

#siriously

Seriously (boring) improvements

We've been seriously hard at work doing all the boring stuff. We've been laying more groundwork for external modules, tweaking our payload generation tools, cleaning up old dependencies, and testing the living daylights out of MS17-010 exploits.

Why all the boring stuff? So you can have serious fun with the exciting stuff! We'd love to watch you contribute to Metasploit with more exploits, post-exploitation ideas, or external modules!

Get it

As always, you can update to the latest Metasploit Framework with msfupdate, and you can get more details on the changes since the last blog post from GitHub:

To install fresh, check out the open-source-only Nightly Installers, or the binary installers which also include the commercial editions. PLEASE NOTE that these installers, and Metasploit Framework versions included in Linux pentesting distros, such as Kali and Parrot, are based off the stable Metasploit 4 branch. If you'd like to try out the newer things going into Metasploit 5, that work is available in the master branch of the Metasploit Framework Github repo.