Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #19196, Cacti import package RCE This exploit module leverages an arbitrary file write vulnerability (CVE-2024-25641) in Cacti versions prior to 1.2.27 to achieve RCE. It abuses the Import Packages feature to upload a specially crafted package that embeds a PHP file.	Jun 12, 2024	jheysel-r7
Land #19243, Add exploit for CVE-2024-1800 (Telerik Report Deserialization RCE) Merge branch 'land-19243' into upstream-master	Jun 12, 2024	bwatters-r7
Land #19223, wp_ajax_load_more_file_upload.rb : Updated original author	Jun 12, 2024	zgoldman-r7
Land #19242, Add exploit for CVE-2024-4358 (Telerik Report Server Auth Bypass) Merge branch 'land-19242' into upstream-master	Jun 11, 2024	bwatters-r7
Land #19240, Rejetto HTTP File Server (HFS) 2.x - Unauthenticated RCE exploit module (CVE-2024-23692) Merge branch 'land-19240' into upstream-master	Jun 11, 2024	bwatters-r7
Land #19239, update Zoomeye module	Jun 11, 2024	adfoster-r7

Title

Date

Author

Land #19196, Cacti import package RCE This exploit module leverages an arbitrary file write vulnerability (CVE-2024-25641) in Cacti versions prior to 1.2.27 to achieve RCE. It abuses the Import Packages feature to upload a specially crafted package that embeds a PHP file.

Jun 12, 2024

jheysel-r7

Land #19243, Add exploit for CVE-2024-1800 (Telerik Report Deserialization RCE) Merge branch 'land-19243' into upstream-master

Jun 12, 2024

bwatters-r7

Land #19223, wp_ajax_load_more_file_upload.rb : Updated original author

Jun 12, 2024

zgoldman-r7

Land #19242, Add exploit for CVE-2024-4358 (Telerik Report Server Auth Bypass) Merge branch 'land-19242' into upstream-master

Jun 11, 2024

bwatters-r7

Land #19240, Rejetto HTTP File Server (HFS) 2.x - Unauthenticated RCE exploit module (CVE-2024-23692) Merge branch 'land-19240' into upstream-master

Jun 11, 2024

bwatters-r7

Land #19239, update Zoomeye module

Jun 11, 2024

adfoster-r7

Latest Pull Requests

Name	Labels	Author
Fix warnings in acceptance tests		adfoster-r7
Reintroduce windows acceptance tests	rn-no-release-notes	adfoster-r7
remove duplicated rescue	rn-fix	zgoldman-r7
Dry BUNDLER_WITHOUT config	rn-no-release-notes	adfoster-r7
dledda-mailmap	easy , rn-no-release-notes	dledda-r7
Add exploit for CVE-2024-1800 (Telerik Report Deserialization RCE)	module , docs , rn-modules	zeroSteiner

Name

Labels

Author

Fix warnings in acceptance tests

adfoster-r7

Reintroduce windows acceptance tests

rn-no-release-notes

adfoster-r7

remove duplicated rescue

rn-fix

zgoldman-r7

Dry BUNDLER_WITHOUT config

rn-no-release-notes

adfoster-r7

dledda-mailmap

easy , rn-no-release-notes

dledda-r7

Add exploit for CVE-2024-1800 (Telerik Report Deserialization RCE)

module , docs , rn-modules

zeroSteiner

Create a Pull Request

Recent Blog Posts

Fri Jun 14 2024

Metasploit Weekly Wrap-Up 06/14/2024

New module content (5) Telerik Report Server Auth Bypass Authors: SinSinology and Spencer McIntyre Type: Auxiliary Pull request: #19242 contributed by zeroSteiner Path: scanner/http/telerik_report_server_auth_bypass AttackerK...

Fri Jun 07 2024

Metasploit Weekly Wrap-Up 06/07/2024

This release features the addition of several new binary OSX stageless payloads with aarch64 support: Execute Command, Shell Bind TCP, & Shell Reverse TCP....

Fri May 31 2024