Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Latest Metasploit Modules

Title	Date	Author
Land #19274, Ivanti EPM SQLi to RCE This adds an exploit for CVE-2024-29824, an unauthenticated SQLi which can be used to obtain RCE in Ivanti Endpoint Manager 2022 SU5 and prior	Jul 08, 2024	jheysel-r7
Land #19295, MOVEit Transfer SFTP auth bypass	Jul 04, 2024	dledda-r7
Land #19204, Zyxel VPN Series Pre-auth Command Injection	Jul 03, 2024	cdelafuente-r7
Land #10113, Azure CLI steal tokens post module.	Jul 03, 2024	dledda-r7
Land #19289, Update apache_nifi_credentials algo regex	Jun 28, 2024	adfoster-r7
Land #19205, Add MS-NRPC users enumeration module	Jun 24, 2024	smcintyre-r7

Title

Date

Author

Land #19274, Ivanti EPM SQLi to RCE This adds an exploit for CVE-2024-29824, an unauthenticated SQLi which can be used to obtain RCE in Ivanti Endpoint Manager 2022 SU5 and prior

Jul 08, 2024

jheysel-r7

Land #19295, MOVEit Transfer SFTP auth bypass

Jul 04, 2024

dledda-r7

Land #19204, Zyxel VPN Series Pre-auth Command Injection

Jul 03, 2024

cdelafuente-r7

Land #10113, Azure CLI steal tokens post module.

Jul 03, 2024

dledda-r7

Land #19289, Update apache_nifi_credentials algo regex

Jun 28, 2024

adfoster-r7

Land #19205, Add MS-NRPC users enumeration module

Jun 24, 2024

smcintyre-r7

Contribute a Module

Latest Pull Requests

Name	Labels	Author
Pin FFI version	rn-no-release-notes	adfoster-r7
remove duplicate word in wiki docs	docs , rn-documentation	h00die
Exploit module for CVE-2024-21683 - Atlassian Confluence administrator-level RCE	module , docs , rn-modules	remmons-r7
Fix loading Mettle extensions	rn-fix	adfoster-r7
MS-9451 Update setting up a developer environment documentation	rn-documentation	adeherdt-r7
MS-9457 Support `NO_AUTH_REQUIRED`	rn-enhancement	adeherdt-r7

Name

Labels

Author

Pin FFI version

rn-no-release-notes

adfoster-r7

remove duplicate word in wiki docs

docs , rn-documentation

h00die

Exploit module for CVE-2024-21683 - Atlassian Confluence administrator-level RCE

module , docs , rn-modules

remmons-r7

Fix loading Mettle extensions

rn-fix

adfoster-r7

MS-9451 Update setting up a developer environment documentation

rn-documentation

adeherdt-r7

MS-9457 Support `NO_AUTH_REQUIRED`

rn-enhancement

adeherdt-r7

Create a Pull Request

Recent Blog Posts

Fri Jul 12 2024

Metasploit Weekly Wrap-Up 07/12/2024

The Usual Suspects This release features two new exploits targeting old friends: Confluence and Ivanti. CVE-2024-21683 is a very easy vulnerability to exploit, but as pointed out in the AttackerKB Review, it requires authen...

Fri Jul 05 2024

Metasploit Weekly Wrap-Up 07/05/2024

3 new modules - MOVEit Transfer authentication bypass CVE-2024-5806, Zyxel command injection, and Azure CLI credentials gatherer...

Fri Jun 28 2024

Metasploit Weekly Wrap-Up 06/28/2024

Unauthenticated Command Injection in Netis Router This week's Metasploit release includes an exploit module for an unauthenticated command injection vulnerability in the Netis MW5360 router which is being tracked as CVE-2024-...

View More Metasploit Blog Posts