Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #19557, Add Palo Alto Expedition RCE (CVE-2024-5910 & CVE-2024-9464) Module Palo Alto Expedition RCE (CVE-2024-5910 & CVE-2024-9464) Module	Nov 12, 2024	bwatters-r7
Land #19518, Add support for RISC-V 32-bit / 64-bit Little Endian payloads	Nov 01, 2024	dwelch-r7
Land #19528, Add Python exec payload Add a python/exec payload to execute OS commands	Oct 31, 2024	bwatters-r7
Land #19499, Adds SolarWinds Help Desk Backdoor module This adds a new module which exploits a backdoor in SolarWinds Web Help Desk (CVE-2024-28987) <= v12.8.3 which enables attackers to retrieve all tickets currently logged in the application.	Oct 31, 2024	jheysel-r7
Land #19517, Add WooCommerce SQLi module This adds a new auxiliary module that exploits an unauthenticated SQL injection vulnerability in the TI WooCommerce Wishlist plugin for WordPress (versions <= 2.8.2). The vulnerability allows attackers to execute SQL queries via the order parameter which can be used to dump usernames and their hashed passwords.	Oct 31, 2024	jheysel-r7
Land #19527 Add bypass for GiveWP RCE (CVE-2024-8353) This updates the exploit module wp_giveup_rce_bypass to incorporate the bypass CVE, allowing the payload to work on all affected versions of the GiveWP plugin.	Oct 30, 2024	jheysel-r7

Title

Date

Author

Land #19557, Add Palo Alto Expedition RCE (CVE-2024-5910 & CVE-2024-9464) Module Palo Alto Expedition RCE (CVE-2024-5910 & CVE-2024-9464) Module

Nov 12, 2024

bwatters-r7

Land #19518, Add support for RISC-V 32-bit / 64-bit Little Endian payloads

Nov 01, 2024

dwelch-r7

Land #19528, Add Python exec payload Add a python/exec payload to execute OS commands

Oct 31, 2024

bwatters-r7

Land #19499, Adds SolarWinds Help Desk Backdoor module This adds a new module which exploits a backdoor in SolarWinds Web Help Desk (CVE-2024-28987) <= v12.8.3 which enables attackers to retrieve all tickets currently logged in the application.

Oct 31, 2024

jheysel-r7

Land #19517, Add WooCommerce SQLi module This adds a new auxiliary module that exploits an unauthenticated SQL injection vulnerability in the TI WooCommerce Wishlist plugin for WordPress (versions <= 2.8.2). The vulnerability allows attackers to execute SQL queries via the order parameter which can be used to dump usernames and their hashed passwords.

Oct 31, 2024

jheysel-r7

Land #19527 Add bypass for GiveWP RCE (CVE-2024-8353) This updates the exploit module wp_giveup_rce_bypass to incorporate the bypass CVE, allowing the payload to work on all affected versions of the GiveWP plugin.

Oct 30, 2024

jheysel-r7

Latest Pull Requests

Name	Labels	Author
Load Readline without a conditional	rn-no-release-notes	sjanusz-r7
Fix IRB deadlock recursive locking on Ctrl+C	rn-no-release-notes	sjanusz-r7
Fix `auxiliary/admin/kerberos/get_ticket` issue on Windows	bug , rn-fix	cdelafuente-r7
Deprecate real-readline option	rn-no-release-notes	sjanusz-r7
Fix crash when using modules	rn-no-release-notes	adfoster-r7
MS-9862 Ruby on Rails Upgrade Preparation : Migration		adeherdt-r7

Name

Labels

Author

Load Readline without a conditional

rn-no-release-notes

sjanusz-r7

Fix IRB deadlock recursive locking on Ctrl+C

rn-no-release-notes

sjanusz-r7

Fix `auxiliary/admin/kerberos/get_ticket` issue on Windows

bug , rn-fix

cdelafuente-r7

Deprecate real-readline option

rn-no-release-notes

sjanusz-r7

Fix crash when using modules

rn-no-release-notes

adfoster-r7

MS-9862 Ruby on Rails Upgrade Preparation : Migration

adeherdt-r7

Create a Pull Request

Recent Blog Posts

Fri Nov 15 2024

Metasploit Weekly Wrap-Up: 11/15/2024

This week's Metasploit Weekly Wrap-Up includes an exploit module for the Palo Alto Expedition exploit chain that's been making headlines recently....

Fri Nov 08 2024

Metasploit Wrap-Up: 11/08/2024

This release of Metasploit Framework has added exciting new features such as new payloads that target the RISC-V architecture. Learn more!...

Fri Nov 01 2024

Metasploit Weekly Wrap-Up 11/01/2024

This Metasploit-Framework release includes a new injection technique deployed on core Meterpreter functionalities such as process migration & DLL Injection....

View More Metasploit Blog Posts