Metasploit Recent Releases / Feb 27, 2023

Feb 27, 20234.22.0-2023022701

Improved

  • Pro: We improved the task log detail page to only offer cleanup tasks when applicable such as when there is a session.

  • PR 17594 - The DLL template code has been updated so that tools such as msfvenom can use DLL templates with payloads that were larger than 4096 bytes, such as unstaged payloads. Note that this update only applies to the default DLL templates that Metasploit provides, and not to external DLL templates which are restricted to 4096 bytes at this time.

  • PR 17674 - Updates the script/resource/basic_discovery.rc script to better detect when the Metasploit database is not connected as well as improving error output.

Fixed

  • Pro: We improved the consistency of dates and times in reports to be more consistent throughout the report.

  • PR 17645 - Fixes a bug that caused warnings to be outputted on Arch Linux environments when starting msfconsole.

  • PR 17650 - Updates the script/resource/basic_discovery.rc script to support commas in RHOST values.

  • PR 17660 - This updates the location of where registry hives are temporarily stored by the windows_secrets_dump module.

  • PR 17663 - This fixes an issue where action names were being treated as case sensitive.

Modules

  • PR 17599 - An exploit for Cisco RV160, RV260, RV340 and RV345 Small Buisness Routers prior to firmware version 1.0.03.26 has been added which exploits CVE-2022-20705, an authentication bypass, and CVE-2022-20707, a command injection vulnerability, to achieve remote code execution as the www-data user on affected devices as a unauthenticated attacker.

  • PR 17640 - This module exploits a vulnerability in various versions of Froxlor that allows an authenticated user to change the default log file to an arbitrary path on the system. Using this, an authenticated user can write a Twig template, that when rendered, will execute arbitrary code and grant a shell or meterpreter session as the www-data user.

  • PR 17652 - This adds an exploit for CVE-2023-0297 which is an unauthenticated Javascript injection in pyLoad's Click 'N' Load service.

Offline Update

Metasploit Framework and Pro Installers