Metasploit Demo Meeting 2020-02-25
Channel: Metasploit
Date: 2020-02-26

The Rapid7 Metasploit development team discusses (and demonstrates!) ongoing Metasploit work and features during their bimonthly sprint meeting, including the following NEW modules:

* OpenSMTPD ‘MAIL FROM’ Remote Code Execution (CVE-2020-7247)
* WordPress InfiniteWP Client Authentication Bypass
* Anviz CrossChex Buffer Overflow Remote Code Execution (CVE-2019-12518)
* Ricoh Driver Privilege Escalation (CVE-2019-19363)
* Diamorphine Rootkit Signal Privilege Escalation
* Windows Gather TeamViewer Passwords (CVE-2019-18988)
* Apache James Server 2.3.2 Insecure User Creation Arbitrary File Write (CVE-2015-7611)
* SSH Key Persistence for Windows

Also included in this recording are demonstrations of the OpenSMTPD, Ricoh, Apache James, and SSH Key Persistence for Windows modules, plus a demo of a recently landed PR for SSH payload support.  Good stuff!

And there's also a number of enhancements and a couple of bug fixes we cover, too!

Lastly, we launched our Beta program for a new web app we've been building called AttackerKB (Attacker Knowledge Base!).  AttackerKB is a new resource to highlight hacker community knowledge on which vulns matter most — and why!  You can find a recent write-up containing details and Beta sign up information, if you'd like to participate, at https://blog.rapid7.com/.

See all the latest modules, PRs, Metasploit blogs, and contributors at https://metasploit.com.