This release features a module leveraging CVE-2023-22515, a vulnerability in Atlassian’s on-premises Confluence Server first listed as a privilege escalation, but quickly recategorized as a “broken access control” with a CVSS score of 10. The exploit itself is very simple and easy to use so there was little surprise when CISA published an advisory stating that threat actors were using it in the wild. It is imperative that anyone using the affected versions mitigate risk and patch as quickly as possible.
This release enhances the sessions command with additional search filters, for instance:
# Return all sessions that have a session id of 1 or 5
sessions -S 'sesion_id:1 session_id:5'
# Return all sessions that have a session_type equal to meterpreter
sessions -S 'session_type:meterpreter'
# Return all sessions that have a check in time between 1 hour and 10 minutes, and less than 2 hours
sessions -S 'last_checkin:greater_than:1h10m last_checkin:less_than:2h'
These search options can be used in conjunction with other session options. For instance the --verbose
flag:
msf6 exploit(windows/smb/psexec) > sessions -S 'last_checkin:greater_than:2h30m' -v
Active sessions
===============
Session ID: 8
Name:
Type: meterpreter windows
Info: NT AUTHORITY\SYSTEM @ WINDEV
Tunnel: 192.168.123.1:4444 -> 192.168.123.132:50564 (192.168.123.132)
Via: exploit/windows/smb/psexec
Encrypted: Yes (AES-256-CBC)
UUID: 4d78f75abbdbf0c8/x86=1/windows=1/2023-10-19T19:44:23Z
CheckIn: 18003s ago @ 2023-10-19 15:45:30 +0100
Registered: No
Session ID: 9
Name:
Type: meterpreter windows
Info: NT AUTHORITY\SYSTEM @ WINDEV
Tunnel: 192.168.123.1:4444 -> 192.168.123.132:50565 (192.168.123.132)
Via: exploit/windows/smb/psexec
Encrypted: Yes (AES-256-CBC)
UUID: 48d32692e0633293/x86=1/windows=1/2023-10-19T19:44:23Z
CheckIn: 10803s ago @ 2023-10-19 17:45:30 +0100
Registered: No
Or as an easy way to search for and kill matching stale sessions with --kill-all
:
msf6 exploit(windows/smb/psexec) > sessions -S 'last_checkin:greater_than:2h30m' -K
[*] Killing matching sessions...
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
4 meterpreter x86/windows NT AUTHORITY\SYSTEM @ WINDEV 192.168.123.1:4444 -> 192.168.123.132:50540 (192.168.123.132)
5 meterpreter x86/windows NT AUTHORITY\SYSTEM @ WINDEV 192.168.123.1:4444 -> 192.168.123.132:50555 (192.168.123.132)
[*] 192.168.123.132 - Meterpreter session 4 closed.
[*] 192.168.123.132 - Meterpreter session 5 closed.
Authors: Naveen Sunkavally, Spencer McIntyre, h00die, and paradoxis
Type: Exploit
Pull request: #18351 contributed by h00die
Path: linux/http/apache_superset_cookie_sig_rce
Description: This adds an exploit for CVE-2023-37941 which is an authenticated RCE in Apache Superset.
Author: sfewer-r7
Type: Exploit
Pull request: #18461 contributed by sfewer-r7
Path: multi/http/atlassian_confluence_rce_cve_2023_22515
Description: This adds an exploit module that leverages an improper input validation issue in Atlassian Confluence versions between 8.0.0 through to 8.3.2, 8.4.0 through to 8.4.2, and 8.5.0 through to 8.5.1. This vulnerability is identified as CVE-2023-22515 and allows unauthenticated remote code execution. The module first creates a new administrator by abusing the embedded XWorks2 middleware and uploading a malicious plugin to get code execution. Note that the module is currently not able to delete the new administrator account it created. This would require a manual clean up.
creds
command to additionally show any cracked passwords that have been created by the auxiliary/analyze/crack_databases
module or similar.-r
and --reload-libs
to the check
, recheck
, to_handler
, reload
, run
and rerun
commands. This new option will reload all library files before performing the original command.msfdb init
the user is no longer prompted for database deletion. The message for clearing unused data service credentials has been reworded.creds
to work with the remote database.handler/reverse_ssh
module that was returning warnings when msfconsole was booted on a Windows machine.scanner/mysql/mysql_authbypass_hashdump
module to now correctly close sockets.You can always find more documentation on our docsite at docs.metasploit.com.
As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:
If you are a git
user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).