Metasploit Demo Meeting 2020-07-14
Channel: Metasploit
Date: 14/07/2020

The Rapid7 Metasploit development team discusses (and demonstrates!) ongoing Metasploit work and features during their bimonthly sprint meeting, including the following NEW modules:

* Netgear R6700v3 Unauthenticated LAN Admin Password Reset to RCE (CVE-2020-10923, ZDI-20-0703, CVE-2020-10924, ZDI-20-704)
* F5 BIG-IP TMUI Directory Traversal and File Upload to RCE (CVE-2020-5902)
* AnyDesk GUI Format String Write RCE (CVE-2020-13160)
* ATutor 2.2.4 - Directory Traversal Remote Code Execution (CVE-2019-12169)
* Bolt CMS 3.7.0 - Authenticated Remote Code Execution
* openSIS Unauthenticated PHP Code Execution (CVE-2020-13383)
* FortiMail Unauthenticated Login Bypass Scanner (CVE-2020-9294)
* Directory Traversal in Spring Cloud Config Server (CVE-2020-5410)

Also included in this recording are demonstrations of the NETGEAR, F5 BIG-IP, AnyDesk, and ATutor modules, plus our new msfconsole command: 'debug'.  Check 'em out!

And there's some enhancements and bug fixes we cover, too!

Also, our new web app that we've been building called AttackerKB (Attacker Knowledge Base) is NOW IN OPEN BETA!!!  AttackerKB is a new resource to highlight hacker community knowledge on which vulns matter most — and why!  You can check out the site yourself at https://attackerkb.com!  For more details, you can find our recent "Meet AttackerKB" post at https://blog.rapid7.com/.

See all the latest modules, PRs, Metasploit blogs, and contributors at https://metasploit.com.