Roadmap

Metasploit 3.5

Due in 25 days (09/27/2010)

23%

30 closed (15%)   174 open (85%)

Related issues
Feature #152: Add SMB signing support to the SMB stack
Feature #244: reload payloads with rexploit
Feature #308: db_use (Scanner like exploit module launcher)
Feature #310: Priv extension support for dumping cached password entries
Feature #319: Provide stats on the success likelihood of a given exploit
Feature #332: sort and use gathered usernames/hashes in aux modules
Feature #357: NTLM auth for MSSQL modules
Feature #388: Add Domain / Workgroup / Computer Detection for PSEXEC and other SMB modules
Feature #389: Install via Token / PTH functionality for Meterpreter
Feature #391: Macterpreter, Nixterpreter, SQLterpreter
Feature #406: Full Java Payload Support
Feature #417: Meterpreter 'mount' remote file system
Feature #420: Functional SMB file server required to implement some exploits
Feature #421: Utility to generate module templates for (exploit, auxiliary, payload, encoder, nop)
Feature #428: Meterpreter script to automatically exploit weak service permissions
Feature #440: DCERPC Enumeration modules should resolve UUIDs to known names
Feature #444: DNS Tunneling for Meterpreter and Multi/Handler
Feature #445: Standalone Meterpreter (non-staged)
Feature #455: Integrate SQLMap's UDF libraries and SQL routines
Feature #459: psexec executable signing for use against Windows Server
Feature #477: Allow global variables to affect db_autopwn
Feature #485: Support running under the jRuby interpreter
Feature #487: Start ratproxy when starting wmap.
Feature #498: back command should work like popd
Feature #499: Move mixins into the modules directory, allow exploits to derive from a base template
Feature #500: Handle code duplication between fileformat, browser, and smtp mixins
Feature #502: The msfgui interface is no longer supported
Feature #527: Add ability for MSFPayload to include Meterpreter scripts in build
Feature #528: SSL Strip for Meterpreter
Feature #564: help command should take an argument
Feature #568: The metsvc should allow the service name and port to be modified by the user.
Feature #588: HTTP based server for serving file format exploits
Feature #589: allow msfpayload functionality inside msfconsole
Feature #595: statistics for browser_autopwn
Feature #598: create some wuftpd exploits
Feature #603: Provide better wrapping in msfconsole
Feature #613: Create a standard 'msfupdate' script and add to the root of SVN tree
Feature #653: several auxillary modules should probably be exploits instead
Feature #654: Windows 'cmd' stagers required
Feature #661: Metepreter should have a config file for loading aliases
Feature #664: The resource command should tab complete filenames
Feature #679: Update screenshot plugin to work on sessions in parallel
Feature #684: Egghunter Improvements
Feature #700: Meterpreter script to enumate USB storage registry entries
Feature #704: msfencode should be able to generate a .docxm or .xlsxm
Feature #705: msfencode input template for .docxm and/or .xlsxm
Feature #706: msfencode input template for .pdf
Feature #707: msfencode should be able to generate a .pdf
Feature #710: Expose meterpreter sessions as WebDAV service
Feature #712: Update the token hunter to work on sessions in parallel
Feature #715: Ability to install metasploit to an alternative directory (Linux)
Feature #718: Enumerate wireless interfaces and show nearby APs
Feature #738: enable creating a resource file from the commands executed since the start of the session
Feature #749: search local database support
Feature #752: Local "Port-forwarding"
Feature #755: Shadow Copy / Restore Point File reader
Feature #759: Meterpreter User and Group List
Feature #760: Meterpreter Clipboard Access
Feature #761: Meterpreter Windows Service Manipulation
Feature #765: OpenOffice Basic equivalent to MS Office VBA Payloads
Feature #781: Sound and Video Recording for Meterpreter
Feature #788: Discovering Dual Stack Hosts
Feature #793: Meterpreter priv extension should be able to dump logged on users' NTLM hashes
Feature #816: Create user enumeration modules for PostgreSQL
Feature #954: Support UPnP and/or STUN
Feature #959: Extend adobe_pdf_embedded_exe to work on multiple pdf viewers
Feature #1070: token hunter continue from session x
Feature #1071: token hunter should automatically continue to the next session on any errors (if possible)
Feature #1083: Brute force version of modules/auxiliary/scanner/oracle/xdb_sid.rb and patch for xdb_sid
Feature #1233: Added features to smb_enumshares as smb_enumshares_rw
Feature #1287: Replace msfcli with a wrapper around msfconsole
Feature #1547: specified scripts/meterperter/credcollect helpmessage
Feature #1654: Metasploit module for weak Debian SSH keys
Feature #1728: Add Oliver "illegalguy" Kleinecke's win32-sshclient meterpreter script
Feature #1832: Proposal of some commands for walking through the filesystem
Feature #1867: Windows Service Control Extension
Feature #1876: More windows CMD payloads
Feature #1975: pull hashes / passwords from mssql, mysql, postgres and oracle
Feature #2017: convert more uses of to_win32_pe or to_executable to use Msf::Exploit::EXE
Feature #2024: Enhanced persistence.rb meterpreter script
Feature #2092: Meterpreter download maximum file size
Feature #2227: Plugin for email notification of session opening/closing ala Robin Wood's sounds plugin
Feature #2228: integrate Sven Taute's JSidle JS encoder
Feature #2231: sessions command needs a redisign to control sessions more easily without interacting
Feature #2306: ARM payload - Linux Execute Command
Feature #2391: meterpreter script to list mapped drivers
Feature #2398: Ability to specify a template exe for .to_win32_service similar to .to_win32pe
Feature #2412: Create a Creds table for credentials

Metasploit 3.6

50%

1 closed (50%)   1 open (50%)

Related issues
Feature #1396: db_nmap on subnets routed through a meterpreter session

Open Backlog

13%

8 closed (10%)   70 open (90%)

Related issues
Feature #181: Meterpreter-based discovery tools / port scanners
Feature #303: Add auxliary modules for MITM tasks
Feature #315: Exploit fragmentation for IPS evasion
Feature #326: Add autoproxy detection to payloads
Feature #387: Local Exploits
Feature #390: Arpscan for Meterpreter
Feature #403: Binary (nix/win) building of modules (not just exploits)
Feature #411: Add netcat-like advanced features to CONNECT
Feature #503: The msfweb interface is no longer supported
Feature #810: a printer driver to load dll in kernel mode ala "print a shell" in hackin9
Feature #1205: meterpreter unix functions
Feature #1289: Obtain VNC PW from Registry via Meterpreter
Feature #1336: Added ability to set timeout on priv/hashdump
Feature #1357: Get passwords with meterpreter
Feature #1474: Notification when Jobs quit
Feature #1487: LDAP Enumeration Module
Feature #1536: exploit debugging features need a serious overhaul
Feature #1712: Create a module for TikiWiki 1.9.8.1 graph_formula vuln
Feature #1733: add KEY_WOW64 registry flag option
Feature #1787: Infecting *.wma and *.wmv file
Feature #1801: dir_listing.rb (<title>#{ip} - /</title>)
Feature #1815: Import the Nmap services db to enable --top-ports port specification option in auxiliary port scanners
Feature #1894: Remote Registry commands for Meterpreter
Feature #1913: Update SIP enumerator.rb to support TCP and SSL (sips)
Feature #1936: Meterpreter should be able to look up account SIDs to names
Feature #1978: ability to delete hosts/ports/notes in the database needs to be exposed
Feature #2029: msfopcode database needs to be updated
Feature #2052: Sort database by IP address
Feature #2056: Match output of db_services to nmap.
Feature #2057: New payloads or payload customization for AV evasion?
Feature #2070: Finalizer for Process Class
Feature #2087: Meterpreter should allow showing full command line of running processes
Feature #2090: add Date Added column to module table
Feature #2097: Sessions command should be more user-friendly
Feature #2104: Add "missing" features from meta-phish to exploit/multi/browser/java_signed_applet
Feature #2121: Hashdump backgrouding
Feature #2122: Metsvc Encoding
Feature #2127: include esser's php post-exploitation stuff in php meterpreter
Feature #2175: support for grabbing cached passwords on windows
Feature #2214: import common windows error codes into metasploit
Feature #2455: allow returning to a running job's module context