Skip to content

Commit a3498db

Browse files
author
jenkins-metasploit
committed
automatic module_metadata_base.json update
1 parent 6e06963 commit a3498db

File tree

1 file changed

+164
-2
lines changed

1 file changed

+164
-2
lines changed

‎db/modules_metadata_base.json‎

Lines changed: 164 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -837,7 +837,7 @@
837837
"Spencer McIntyre",
838838
"jheysel-r7"
839839
],
840-
"description": "This module exploits Active Directory Certificate Services (AD CS) template misconfigurations, specifically\n ESC9, ESC10, and ESC16, by updating an LDAP object and requesting a certificate on behalf of a target user.\n The module leverages the auxiliary/admin/ldap/ldap_object_attribute module to update the LDAP object and the\n admin/ldap/shadow_credentials module to add shadow credentials for the target user. It then uses the\n admin/kerberos/get_ticket module to retrieve the NTLM hash of the target user and requests a certificate via\n MS-ICPR. The resulting certificate can be used for various operations, such as authentication.\n\n The module ensures that any changes made by the ldap_object_attribute or shadow_credentials module are\n reverted after execution to maintain system integrity.",
840+
"description": "This module exploits Active Directory Certificate Services (AD CS) template misconfigurations, specifically\n ESC9, ESC10, and ESC16, by updating an LDAP object and requesting a certificate on behalf of a target user.\n The module leverages the auxiliary/admin/ldap/ldap_object_attribute module to update the LDAP object and the\n admin/ldap/shadow_credentials module to add shadow credentials for the target user if the target password is\n not provided. It then uses the admin/kerberos/get_ticket module to retrieve the NTLM hash of the target user\n and requests a certificate via MS-ICPR. The resulting certificate can be used for various operations, such as\n authentication.\n\n The module ensures that any changes made by the ldap_object_attribute or shadow_credentials module are\n reverted after execution to maintain system integrity.",
841841
"references": [
842842
"URL-https://github.com/GhostPack/Certify",
843843
"URL-https://github.com/ly4k/Certipy",
@@ -856,7 +856,7 @@
856856
"microsoft-ds"
857857
],
858858
"targets": null,
859-
"mod_time": "2025-07-30 15:28:56 +0000",
859+
"mod_time": "2025-09-25 13:35:41 +0000",
860860
"path": "/modules/auxiliary/admin/dcerpc/esc_update_ldap_object.rb",
861861
"is_install_path": true,
862862
"ref_name": "admin/dcerpc/esc_update_ldap_object",
@@ -18678,6 +18678,130 @@
1867818678
"needs_cleanup": false,
1867918679
"actions": []
1868018680
},
18681+
"auxiliary_fileformat/datablock_padding_lnk": {
18682+
"name": "Windows Shortcut (LNK) Padding",
18683+
"fullname": "auxiliary/fileformat/datablock_padding_lnk",
18684+
"aliases": [],
18685+
"rank": 300,
18686+
"disclosure_date": "2025-07-19",
18687+
"type": "auxiliary",
18688+
"author": [
18689+
"Nafiez"
18690+
],
18691+
"description": "This module generates Windows LNK (shortcut) file that can execute\n arbitrary commands. The LNK file uses environment variables and execute\n its arguments from COMMAND_LINE_ARGUMENTS with extra juicy whitespace\n character padding bytes and concatenates the actual payload.",
18692+
"references": [
18693+
"ZDI-25-148",
18694+
"URL-https://zeifan.my/Windows-LNK/",
18695+
"URL-https://gist.github.com/nafiez/1236cc4c808a489e60e2927e0407c8d1",
18696+
"URL-https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html"
18697+
],
18698+
"platform": "Windows",
18699+
"arch": "",
18700+
"rport": null,
18701+
"autofilter_ports": [],
18702+
"autofilter_services": [],
18703+
"targets": null,
18704+
"mod_time": "2025-09-29 10:12:50 +0000",
18705+
"path": "/modules/auxiliary/fileformat/datablock_padding_lnk.rb",
18706+
"is_install_path": true,
18707+
"ref_name": "fileformat/datablock_padding_lnk",
18708+
"check": false,
18709+
"post_auth": false,
18710+
"default_credential": false,
18711+
"notes": {
18712+
"Stability": [
18713+
"crash-safe"
18714+
],
18715+
"Reliability": [],
18716+
"SideEffects": [
18717+
"artifacts-on-disk"
18718+
]
18719+
},
18720+
"session_types": false,
18721+
"needs_cleanup": false,
18722+
"actions": []
18723+
},
18724+
"auxiliary_fileformat/environment_variable_datablock_leak": {
18725+
"name": "Right-Click Execution - Windows LNK File Special UNC Path NTLM Leak",
18726+
"fullname": "auxiliary/fileformat/environment_variable_datablock_leak",
18727+
"aliases": [],
18728+
"rank": 300,
18729+
"disclosure_date": "2025-05-06",
18730+
"type": "auxiliary",
18731+
"author": [
18732+
"Nafiez"
18733+
],
18734+
"description": "This module creates a malicious Windows shortcut (LNK) file that\n specifies a special UNC path in EnvironmentVariableDataBlock of Shell Link (.LNK)\n that can trigger an authentication attempt to a remote server. This can be used\n to harvest NTLM authentication credentials.\n\n When a victim right-click the generated LNK file, it will attempt to connect to the\n the specified UNC path, resulting in an SMB connection that can be captured\n to harvest credentials.",
18735+
"references": [
18736+
"URL-https://zeifan.my/Right-Click-LNK/"
18737+
],
18738+
"platform": "Windows",
18739+
"arch": "",
18740+
"rport": null,
18741+
"autofilter_ports": [],
18742+
"autofilter_services": [],
18743+
"targets": null,
18744+
"mod_time": "2025-09-29 11:37:42 +0000",
18745+
"path": "/modules/auxiliary/fileformat/environment_variable_datablock_leak.rb",
18746+
"is_install_path": true,
18747+
"ref_name": "fileformat/environment_variable_datablock_leak",
18748+
"check": false,
18749+
"post_auth": false,
18750+
"default_credential": false,
18751+
"notes": {
18752+
"Stability": [
18753+
"crash-safe"
18754+
],
18755+
"SideEffects": [
18756+
"artifacts-on-disk",
18757+
"screen-effects"
18758+
],
18759+
"Reliability": []
18760+
},
18761+
"session_types": false,
18762+
"needs_cleanup": false,
18763+
"actions": []
18764+
},
18765+
"auxiliary_fileformat/icon_environment_datablock_leak": {
18766+
"name": "IconEnvironmentDataBlock - Windows LNK File Special UNC Path NTLM Leak",
18767+
"fullname": "auxiliary/fileformat/icon_environment_datablock_leak",
18768+
"aliases": [],
18769+
"rank": 300,
18770+
"disclosure_date": "2025-05-16",
18771+
"type": "auxiliary",
18772+
"author": [
18773+
"Nafiez"
18774+
],
18775+
"description": "This module creates a malicious Windows shortcut (LNK) file that\n specifies a special UNC path in IconEnvironmentDataBlock of Shell Link (.LNK)\n that can trigger an authentication attempt to a remote server. This can be used\n to harvest NTLM authentication credentials.\n\n When a victim browse to the location of the LNK file, it will attempt to\n connect to the the specified UNC path, resulting in an SMB connection that\n can be captured to harvest credentials.",
18776+
"references": [
18777+
"URL-https://zeifan.my/Right-Click-LNK/"
18778+
],
18779+
"platform": "Windows",
18780+
"arch": "",
18781+
"rport": null,
18782+
"autofilter_ports": [],
18783+
"autofilter_services": [],
18784+
"targets": null,
18785+
"mod_time": "2025-09-29 11:37:42 +0000",
18786+
"path": "/modules/auxiliary/fileformat/icon_environment_datablock_leak.rb",
18787+
"is_install_path": true,
18788+
"ref_name": "fileformat/icon_environment_datablock_leak",
18789+
"check": false,
18790+
"post_auth": false,
18791+
"default_credential": false,
18792+
"notes": {
18793+
"Stability": [
18794+
"crash-safe"
18795+
],
18796+
"SideEffects": [
18797+
"artifacts-on-disk"
18798+
],
18799+
"Reliability": []
18800+
},
18801+
"session_types": false,
18802+
"needs_cleanup": false,
18803+
"actions": []
18804+
},
1868118805
"auxiliary_fileformat/maldoc_in_pdf_polyglot": {
1868218806
"name": "Maldoc in PDF Polyglot converter",
1868318807
"fullname": "auxiliary/fileformat/maldoc_in_pdf_polyglot",
@@ -18799,6 +18923,44 @@
1879918923
"needs_cleanup": false,
1880018924
"actions": []
1880118925
},
18926+
"auxiliary_fileformat/specialfolder_leak": {
18927+
"name": "SpecialFolderDatablock - Windows LNK File Special UNC Path NTLM Leak",
18928+
"fullname": "auxiliary/fileformat/specialfolder_leak",
18929+
"aliases": [],
18930+
"rank": 300,
18931+
"disclosure_date": "2025-05-10",
18932+
"type": "auxiliary",
18933+
"author": [
18934+
"Nafiez"
18935+
],
18936+
"description": "This module creates a malicious Windows shortcut (LNK) file that\n specifies a special UNC path in SpecialFolderDatablock of Shell Link (.LNK)\n that can trigger an authentication attempt to a remote server. This can be used\n to harvest NTLM authentication credentials.\n\n When a victim browse to the location of the LNK file, it will attempt to\n connect to the the specified UNC path, resulting in an SMB connection that\n can be captured to harvest credentials.",
18937+
"references": [],
18938+
"platform": "Windows",
18939+
"arch": "",
18940+
"rport": null,
18941+
"autofilter_ports": [],
18942+
"autofilter_services": [],
18943+
"targets": null,
18944+
"mod_time": "2025-09-29 11:33:33 +0000",
18945+
"path": "/modules/auxiliary/fileformat/specialfolder_leak.rb",
18946+
"is_install_path": true,
18947+
"ref_name": "fileformat/specialfolder_leak",
18948+
"check": false,
18949+
"post_auth": false,
18950+
"default_credential": false,
18951+
"notes": {
18952+
"Stability": [
18953+
"crash-safe"
18954+
],
18955+
"Reliability": [],
18956+
"SideEffects": [
18957+
"artifacts-on-disk"
18958+
]
18959+
},
18960+
"session_types": false,
18961+
"needs_cleanup": false,
18962+
"actions": []
18963+
},
1880218964
"auxiliary_fileformat/word_unc_injector": {
1880318965
"name": "Microsoft Word UNC Path Injector",
1880418966
"fullname": "auxiliary/fileformat/word_unc_injector",

0 commit comments

Comments
 (0)