Roadmap

Metasploit 4.3.0

Due in 7 days (06/01/2012)

87%

123 issues   (88 closed — 35 open)

Related issues
Feature #244: reload payloads with rexploit
Feature #588: [patch] HTTP server aux module for serving file format exploits
Feature #700: Meterpreter script to enumate USB storage registry entries
Feature #1083: Brute force version of modules/auxiliary/scanner/oracle/xdb_sid.rb and patch for xdb_sid
Feature #1336: Added ability to set timeout on priv/hashdump
Feature #2975: Patch to add db_psexec_scanner
Feature #3060: Remote console to msfrpcd
Feature #3091: assimilate the powershell script from Nick
Feature #3499: compatible_sessions should also check Platform
Feature #3538: allow db_nmap to save output files
Feature #3597: script to "brute force" incognito user add on all sessions
Feature #3679: XML Data Package (XDP) format support for PDF exploits
Feature #3772: Improvement to Meterpreter script getgui
Feature #3826: IPv6 Persistence Meterpreter Script
Feature #3933: (Have Patch) - USB History - Post exploitation script to enumerate USB Drive History
Feature #4056: wmic post module
Feature #4137: Request extended channel I/O commands for meterpreter
Feature #4143: Download and Execute (via Ruby)
Feature #4159: Antiantimeter - A script to kill or mitigate from antimeter
Feature #4288: New windows/gather/Post Module enum_services.rb
Feature #4439: EAP-MD5 offline dictionary attack
Feature #4568: Traffic hijacking via HSRP - racket lib
Feature #4592: OSX vfork() reverse_tcp shellcode
Feature #4604: persistence-hostname.rb
Feature #4650: Module to kill Mcafee AV
Feature #4652: Post Modules should allow user to choose payload and location
Feature #4667: Bug #2105 Contribution by Bercegay
Feature #4694: new windows post module meterpreter_pizza_connection
Feature #4700: enum_opera - meterpreter script
Feature #4711: New Module Submission: DNS MITM
Feature #4712: New Module Submission: DHCP Exhaustion
Feature #4721: Meterpreter script update - virusscan_bypass8_8
Feature #4725: Exchange 2010 OWA Brute Force Module
Feature #4849: Redis Server Scanner
Feature #4929: Microsoft IIS FTP Server <= 7.0 LIST Stack Exhaustion Denial of Service
Feature #5118: Migrated service_manager.rb to Post Module
Feature #5205: New Post Module: unpriv_wmic
Feature #5210: New Post Module: Windows Gather SQL Credentials from McAfee ePO 4.6 Config
Feature #5217: New Modules: hp_printer_pjl_traversal & hp_printer_pjl_cmd
Feature #5218: New Post Module - enum_cred_store.rb
Feature #5270: Railgun - Proposing added functionality to Util for improved handling of structures for both data in and out
Feature #5271: 64 bit nasm_shell
Feature #5291: Need TFTP Client mixin
Feature #5332: Apache Tomcat Directiory Listing
Feature #5338: Add the ability for ruby blocks in rc files to share binding
Feature #5364: Typo3 AUX modules
Feature #5384: Oracle E-Business Suite SQL Injection 11.5.1-11.5.10.2
Feature #5398: AUX module to impersonate ssl certificate
Feature #5411: patch to webdav_internal_ip.rb to allow path to be specified
Feature #5412: webdav_scanner.rb and webdav_website_content.rb PATH patches
Feature #5428: Added support for Local File Inclusion to module php_include.rb
Feature #5442: Improved pattern creator
Feature #5455: Patch for smb_relay.rb to allow the share written to, to be defined in an option
Feature #5481: html report module
Feature #5482: Local Admin Search
Feature #5498: CVE-2011-3493 Cogent Datahub module
Feature #5514: Local Admin to Domain admin aux module
Feature #5541: SAP auxiliary modules - Phase 2
Feature #5580: Additional checks for the existing ssl.rb module
Feature #5592: CyTel Studio <= 9.0 CY3 Stack Buffer Overflow
Feature #5610: Remote unauthenticated root in ctek SkyRouter
Feature #5620: SAP ICM URLscan module
Feature #5680: new exploit: Free MP3 CD Ripper 1.1 Local Buffer Overflow
Feature #5682: phpScheduleIt PHP CVE-2008-6132
Feature #5742: SAP OSexecute Exploit module
Feature #5779: Ported exploit: Mini-Stream RM-MP3 Converter v3.1.2.1 (.pls) Stack Buffer Overflow universal
Feature #5797: Search environment for get_config_root
Feature #5803: Multicast DNS Collector Auxiliary
Feature #5810: fakedns.rb server does not support multiple targets
Feature #5855: [new module] zFTP Server "stat/cwd" Remote Denial-of-Service
Feature #5882: Better DB2 support (grab hashes, cracking (JtR), sql_exec)
Feature #5946: AbsoluteFTP 1.9.6 - 2.2.10 Remote Buffer Overflow (LIST)
Feature #6004: smb_login scanner should have option to not report guest accounts
Feature #6005: Implement CVE-2011-4404 (VMWare dir traversal)
Feature #6014: Add thunderbird credential collector
Feature #6165: pushd/popd-like functionality for msfconsole
Feature #6185: Search feature for db dispatcher commands (hosts etc)
Feature #6343: [POSIX meterpreter] needs a 'make debug' target
Feature #6380: CVE 2009-4656 - DJ Studio Pro 5.1.6.5.2 SEH Exploit
Feature #6493: Lotus CMS 3.0 Exploit
Feature #6499: Enumerate URLs with Bing's search engine
Feature #6508: Add Option for OptURI
Feature #6598: ActiveX browser exploits should support autopwn

Metasploit 4.4.0

23%

114 issues   (2 closed — 112 open)

Related issues
Feature #500: Handle code duplication between fileformat, browser, and smtp mixins
Feature #564: help command should take an argument
Feature #752: Reverse "Port-forwarding", i.e. bind on meterp server and tunnel back to attacker
Feature #3708: plugins should have a searchpath in ~/.msf3/
Feature #3963: Java Payloads in single class file form
Feature #4172: include support for snmp v3
Feature #4905: Make meterpreter capabilities queryable
Feature #5315: include pcaprub in windows installer
Feature #5447: file_stalker: post module for monitoring directories for files matching a glob or a regex
Feature #5661: Add improved database query commands to msfconsole
Feature #5671: Need a strategy for figuring out dependencies for modules
Feature #5681: Modules should be clearer about their specific licenses.
Feature #5880: Try to create post module to loot KeePass
Feature #5950: dir_scanner / brute_dirs module overlap
Feature #6028: List plugins in the plugin tab
Feature #6039: "jobs -v -v" to dump full datastore of running jobs
Feature #6076: 802.11n modules from JWright - fuzz_amsdu & fuzz_proberesp_11n
Feature #6130: lib/msf/core/post/windows/[registry.rb,services.rb] need a rewrite
Feature #6150: the lab_load_config command (of the lab plugin) should tab complete starting from data/lab
Feature #6248: import DnsRecon XML
Feature #6295: Radmin scanner
Feature #6305: Advanced/evasion options in table format
Feature #6416: Meterpreter resource files should support the same features as msf resource files
Feature #6477: [POSIX meterpreter] add ptrace support
Feature #6479: [Posix Meterpreter] Investigate netlink sockets as replacement for libpcap
Feature #6827: "RuggedCom Telnet Password Generator" Module
Feature #6855: adobe_pdf_embedded_exe exploit for Windows XP Spanish
Feature #6863: Avoid receiving a response when sending a HTTP request
Feature #6894: Possible improvement inIomega StorCenter Pro NAS Web Authentication Bypass

Open Backlog

37%

238 issues   (81 closed — 157 open)

Related issues
Feature #181: Meterpreter-based discovery tools / port scanners
Feature #303: Add aux modules for MITM tasks (Arp spoof, sslstrip, iframe injection)
Feature #315: Exploit fragmentation for IPS evasion
Feature #326: Add autoproxy detection to payloads
Feature #332: sort and use gathered usernames/hashes in aux modules
Feature #387: Local Exploits
Feature #388: Add Domain / Workgroup / Computer Detection for PSEXEC and other SMB modules
Feature #389: Install via Token / PTH functionality for Meterpreter
Feature #390: Arpscan for Meterpreter
Feature #403: Binary (nix/win) building of modules (not just exploits)
Feature #406: Full Java Payload Support
Feature #411: Add netcat-like advanced features to CONNECT
Feature #417: Meterpreter 'mount' remote file system
Feature #420: Functional SMB file server required to implement some exploits
Feature #421: Utility to generate module templates for (exploit, auxiliary, payload, encoder, nop)
Feature #444: DNS Tunneling for Meterpreter and Multi/Handler
Feature #445: Standalone Meterpreter (non-staged)
Feature #498: back command should work like popd
Feature #499: Move mixins into the modules directory, allow exploits to derive from a base template
Feature #528: SSL Strip for Meterpreter
Feature #595: statistics for browser_autopwn
Feature #598: create some wuftpd exploits
Feature #603: Provide better wrapping in msfconsole
Feature #653: several auxillary modules should probably be exploits instead
Feature #654: Windows 'cmd' stagers required
Feature #661: Metepreter should have a config file for loading aliases
Feature #679: Update screenshot plugin to work on sessions in parallel
Feature #710: Expose meterpreter sessions as WebDAV service
Feature #712: Update the token hunter to work on sessions in parallel
Feature #718: Enumerate wireless interfaces and show nearby APs
Feature #724: Update RbMysql to allow old-style password hashing (LONG_PASSWORD=0)
Feature #755: Shadow Copy / Restore Point File reader
Feature #759: Meterpreter User and Group List
Feature #760: Meterpreter Clipboard Access
Feature #765: OpenOffice Basic equivalent to MS Office VBA Payloads
Feature #810: a printer driver to load dll in kernel mode ala "print a shell" in hackin9
Feature #816: Create user enumeration modules for PostgreSQL
Feature #954: Support UPnP and/or STUN
Feature #959: Extend adobe_pdf_embedded_exe to work on multiple pdf viewers
Feature #1070: token hunter continue from session x
Feature #1205: meterpreter unix functions
Feature #1289: Obtain VNC PW from Registry via Meterpreter
Feature #1357: Get passwords with meterpreter
Feature #1474: Notification when Jobs quit
Feature #1487: LDAP Enumeration Module
Feature #1536: exploit debugging features need a serious overhaul
Feature #1712: Create a module for TikiWiki 1.9.8.1 graph_formula vuln
Feature #1787: Infecting *.wma and *.wmv file
Feature #1801: dir_listing.rb (<title>#{ip} - /</title>)
Feature #1815: Import the Nmap services db to enable --top-ports port specification option in auxiliary port scanners
Feature #1832: Proposal of some commands for walking through the filesystem
Feature #1913: Update SIP enumerator.rb to support TCP and SSL (sips)
Feature #1978: ability to delete hosts/ports/notes in the database needs to be exposed
Feature #2029: msfopcode database needs to be updated
Feature #2056: Match output of db_services to nmap.
Feature #2057: New payloads or payload customization for AV evasion?
Feature #2087: Meterpreter should allow showing full command line of running processes
Feature #2090: add Date Added column to module table
Feature #2092: Meterpreter download maximum file size
Feature #2097: Sessions command should be more user-friendly
Feature #2104: Add "missing" features from meta-phish to exploit/multi/browser/java_signed_applet
Feature #2121: Hashdump backgrouding
Feature #2122: Metsvc Encoding
Feature #2127: include esser's php post-exploitation stuff in php meterpreter
Feature #2175: support for grabbing cached passwords on windows
Feature #2214: import common windows error codes into metasploit
Feature #2228: integrate Sven Taute's JSidle JS encoder
Feature #2306: ARM payload - Linux Execute Command
Feature #2455: allow returning to a running job's module context
Feature #2480: Addition of the Alpha3 Encoder
Feature #2543: Enhance SEH mixin to support commonly used techniques
Feature #2853: dir_scanner should differentiate between 404 and 301 redirect
Feature #2862: Implement win32 DEP bypass routine inside egg hunter
Feature #2985: update additional exploits modules with reworked http file uploads
Feature #2989: Egghunter should use separate encoder invocation from payload
Feature #2995: Adding XSSF to Metasploit Framework
Feature #2996: Ensure meterpreter and shell scripts report_cred when they're dealing with usernames and passwords
Feature #3140: the framework should provide facilities for conducting automatic target detection
Feature #3181: allow retries for authentication brute force failures
Feature #3182: VNC/RFB: detect view-only sessions when establishing a session
Feature #3218: Create a more coherent way to specify various host/ports
Feature #3261: [cisco] TTL Expiry Attack
Feature #3294: Implement AddedDate and UpdatedDate for modules
Feature #3345: Cisco IOS configuration grabber via SNMP
Feature #3377: Convert meterpreter scripts to Module format
Feature #3381: Improving Lotus Domino Password Hash Collector
Feature #3458: Replace OptPath with OptReadFile and OptWriteFile
Feature #3563: More exploits should record a BufferRegister and/or additional trigger context
Feature #3585: MS08-067 exploit will not work against machines with /NoExecute=AlwaysOn
Feature #3638: New Module - Slow HTTP POST Denial Of Service
Feature #3677: Support post modules that can create sessions via a mixin
Feature #3702: SIP digest leak - exploit module
Feature #3983: Extend VNC library
Feature #4028: Egghunters should have optional support for VirtualAlloc/mprotect
Feature #4067: SpoonFTP <= 1.2 RETR Denial Of Service
Feature #4202: cdecl railgun calls
Feature #4579: SMB Mixin should have SMB2 support
Feature #4582: Mimic StackAdjustment in msfvenom
Feature #4637: Add qemu support to the lab plugin
Feature #4668: Add ESXi suppor to the lab plugin
Feature #4832: CVE-2011-1290 Metasploit Exploit Bounty
Feature #4983: Implement WMI payload delivery
Feature #5227: New module: Solar FTP 2.1.1 PASV Command Buffer Overflow
Feature #5236: Libhijack as a basis for POSIX meterpreter migrate functionality
Feature #5471: KnFTP 1.0.0 Server Remote Buffer Overflow
Feature #5637: Opera Browser 10/11/12 (SVG layout) Memory Corruption
Feature #5703: Portable Windows version
Feature #5921: windows generic arbitrary code execution (using hta/html) module
Feature #5967: Transparent Proxy && Inject HTML/JAVASCRIPT
Feature #6078: DameWare Mini Remote Control Client Agent Service bof
Feature #6089: Exploit module for CVE-2006-0272: Oracle Database XDB.DBMS_XMLSCHEMA.GENERATESCHEMA Buffer Overflow Vulnerability
Feature #6090: Exploit module for CVE-2004-1774: Oracle Database MDSYS.MD2.SDO_CODE_SIZE Buffer Overflow Vulnerability
Feature #6105: Java Post Modules
Feature #6203: Request for features for RC scripts
Feature #6459: Cleartext windows passwords via wdigest