Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #19322, Bump metasploit_payloads-mettle to 1.0.30 Bump metasploit_payloads-mettle to 1.0.30	Jul 15, 2024	smcintyre-r7
Land #19311, Add GeoServer unauth RCE module This adds an exploit module for CVE-2024-36401, an unauthenticated RCE vulnerability in GeoServer versions prior to 2.23.6, between version 2.24.0 and 2.24.3 and in version 2.25.0, 2.25.1.	Jul 12, 2024	jheysel-r7
Land #19274, Ivanti EPM SQLi to RCE This adds an exploit for CVE-2024-29824, an unauthenticated SQLi which can be used to obtain RCE in Ivanti Endpoint Manager 2022 SU5 and prior	Jul 08, 2024	jheysel-r7
Land #19295, MOVEit Transfer SFTP auth bypass	Jul 04, 2024	dledda-r7
Land #19204, Zyxel VPN Series Pre-auth Command Injection	Jul 03, 2024	cdelafuente-r7
Land #10113, Azure CLI steal tokens post module.	Jul 03, 2024	dledda-r7

Title

Date

Author

Land #19322, Bump metasploit_payloads-mettle to 1.0.30 Bump metasploit_payloads-mettle to 1.0.30

Jul 15, 2024

smcintyre-r7

Land #19311, Add GeoServer unauth RCE module This adds an exploit module for CVE-2024-36401, an unauthenticated RCE vulnerability in GeoServer versions prior to 2.23.6, between version 2.24.0 and 2.24.3 and in version 2.25.0, 2.25.1.

Jul 12, 2024

jheysel-r7

Land #19274, Ivanti EPM SQLi to RCE This adds an exploit for CVE-2024-29824, an unauthenticated SQLi which can be used to obtain RCE in Ivanti Endpoint Manager 2022 SU5 and prior

Jul 08, 2024

jheysel-r7

Land #19295, MOVEit Transfer SFTP auth bypass

Jul 04, 2024

dledda-r7

Land #19204, Zyxel VPN Series Pre-auth Command Injection

Jul 03, 2024

cdelafuente-r7

Land #10113, Azure CLI steal tokens post module.

Jul 03, 2024

dledda-r7

Latest Pull Requests

Name	Labels	Author
Bump metasploit_payloads-mettle to 1.0.31	easy	dledda-r7
geoserver_unauth_rce_cve_2024_36401 update (typo in OptString.new)	rn-enhancement	pmauduit
Update rpc compatible modules to handle unknown sessions	rn-fix	adfoster-r7
Bump metasploit_payloads-mettle to 1.0.30	meterpreter , bug , rn-fix	dledda-r7
Pin FFI version	rn-no-release-notes	adfoster-r7
remove duplicate word in wiki docs	docs , rn-documentation	h00die

Name

Labels

Author

Bump metasploit_payloads-mettle to 1.0.31

easy

dledda-r7

geoserver_unauth_rce_cve_2024_36401 update (typo in OptString.new)

rn-enhancement

pmauduit

Update rpc compatible modules to handle unknown sessions

rn-fix

adfoster-r7