Last updated at Thu, 25 Jan 2024 01:37:09 GMT

Bad WebLogic

Our own Shelby Pace authored an exploit taking advantage of a Java object deserialization vulnerability in multiple different versions of WebLogic. The new module has been tested with versions v12.1.3.0.0, v12.2.1.3.0, and v12.2.1.4.0 of WebLogic and allows remote code execution through the of sending a serialized BadAttributeValueExpException object over the T3 protocol to vulnerable WebLogic servers.

Cram it in your Pi-Hole

As the incredibly original and hilarious title has pointed out, Pi-Hole has a Unrestricted File Upload vulnerability! Added by our frequent community contributor h00die, this new module adds a new blocklist to Pi-Hole, forces a gravity update to pull in the blocklist content, then writes PHP content to a file within the webroot, allowing for Remote Code Execution. Tasty.

New modules

Enhancements and features

  • PR #13496 - This adds tests to verify that payloads, when used with the cmd_exec API, return the output of the stderr process stream in their results. Authored by timwr.
  • PR #13443 - This adds or updates action descriptions for numerous auxiliary and post modules in order to improve the user experience when listing or choosing actions. Authored by cnotin.
  • PR #13262 - This adds our first cross-architecture stager/payload. It uses a python stager to load a binary meterpreter stage. Authored by timwr.

Bugs fixed

  • PR #13499 - This fixes a bug in Java meterpreter where the result of the stderr text stream was not returned when used with the cmd_exec post-exploitation API. Authored by timwr and added to MSF by busterb.
  • PR #13493 - Miscellaneous fixes for the ThinkPHP and ManageEngine exploits. Authored by wvu.
  • PR #13492 - This fixes a punctuation issue within the module description and documentation for the Exchange ECP Viewstate exploit. Authored by wvu.
  • PR #13465 - This fixes an issue within Meterpreter's packet dispatcher code where under certain conditions packets would be processed out of order leading to failed protocol negotiation sequences. Authored by OJ.
  • PR #13436 - This fixes a regression in the SERVICE_FILENAME and SERVICE_STUB_ENCODER options in psexec code. Authored by cnotin.
  • PR #13415 - This enhancement/fix changes the behavior of payload encoding in Metasploit, such that payloads free of any specified bad characters skip the encoding phase altogether. Previously, payloads would be unconditionally encoded if any badchars were specified at all. Authored by acammack.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the binary installers (which also include the commercial edition).