Metasploit Demo Meeting 2020-11-17
Channel: Metasploit
Date: 2020-11-18

The Rapid7 Metasploit development team discusses (and demonstrates!) ongoing Metasploit work and features during their bimonthly sprint meeting, including the following NEW modules:

* Mikrotik Winbox Arbitrary File Read (CVE-2018-14847)
* WordPress Loginizer log SQLi Scanner (CVE-2020-27615)
* SaltStack Salt REST API Arbitrary Command Execution (CVE-2020-16846, CVE-2020-25592)
* WordPress File Manager Unauthenticated Remote Code Execution (CVE-2020-25213)
* Rapid7 Metasploit Framework msfvenom APK Template Command Injection (CVE-2020-7384)
* Apache ZooKeeper Information Disclosure

Included in this recording are demos of the new SaltStack, WordPress, and ZooKeeper modules and a few improvements, as well.

Also, our new web app that we've been building called AttackerKB (Attacker Knowledge Base) is NOW GA!!!  AttackerKB is a new resource to highlight hacker community knowledge on which vulns matter most — and why!  You can check out the site yourself at https://attackerkb.com!

See all the latest modules, PRs, Metasploit blogs, and contributors at https://metasploit.com.