Metasploit Demo Meeting 2020-03-10
Channel: Metasploit
Date: 10/03/2020

The Rapid7 Metasploit development team discusses (and demonstrates!) ongoing Metasploit work and features during their bimonthly sprint meeting, including the following NEW modules:

* Exchange Control Panel Viewstate Deserialization Command Execution (CVE-2020-0688)
* OpenNetAdmin Ping Command Injection
* EyesOfNetwork AutoDiscovery Target Command Execution (CVE-2020-8657)
* Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload (CVE-2015-1830)
* PHP-FPM Underflow Remote Code Execution (CVE-2019-11043)
* Google Chrome 80 JSCreate side-effect type confusion Remote Code Execution (CVE-2020-6418)
* Android Binder Use-After-Free Privilege Escalation (CVE-2019-2215)
* OpenSMTPD OOB Read Local Privilege Escalation (CVE-2020-8794)

Also included in this recording are demonstrations of the Exchange Control Panel RCE, OpenNetAdmin Command Injection, EyesOfNetwork RCE, PHP-FPM RCE, Google Chrome RCE, and OpenSMTPD privesc modules.  Noice!

And there's also many enhancements and a bug fix we cover, too!

Lastly, we launched our Beta program for a new web app we've been building called AttackerKB (Attacker Knowledge Base!).  AttackerKB is a new resource to highlight hacker community knowledge on which vulns matter most — and why!  You can find a recent write-up containing details and Beta sign up information, if you'd like to participate, at https://blog.rapid7.com/.

See all the latest modules, PRs, Metasploit blogs, and contributors at https://metasploit.com.