Roadmap

Metasploit 4.2.0

Due in 24 days (03/01/2012)

69%

111 closed (65%)   59 open (35%)

Related issues
Feature #440: DCERPC Enumeration modules should resolve UUIDs to known names
Feature #564: help command should take an argument
Feature #1233: Added features to smb_enumshares as smb_enumshares_rw
Feature #2052: Sort database by IP address
Feature #2706: Add a print status of the session data after sessions creation
Feature #2729: Feature request: implement auxiliary module for CVE-2008-0926
Feature #3061: usbsploit.rb 0.4b into Metasploit
Feature #3254: Payload - Linux/ARM - Create a new user with UID 0
Feature #3289: DNS(SEC) fuzzer
Feature #3386: Cisco VPN enumeration module
Feature #3389: adduser - Provide support for custom group names and WMIC support
Feature #3630: Multithread rpcd, servers
Feature #3678: Specify multiple sessions for post modules
Feature #3708: plugins should have a searchpath in ~/.msf3/
Feature #3723: User detail enumeration module (post)
Feature #3745: add test-services.rb as test/modules/post/test/services.rb
Feature #3759: Convenience methods for HTTP verbs in Http::Client
Feature #3802: revamped libs for msf/core/post/windows[services.rb,registry.rb]
Feature #3894: Additional exe encoder option "vbsmem"
Feature #3963: Java Payloads in single class file form
Feature #4064: New Post module enum_domain_group_members
Feature #4079: ColdFusion Version Scanner Module
Feature #4097: MPlayer Lite Buffer Overflow Exploit
Feature #4297: Expanded Search for Enum_VNC_PW
Feature #4585: jbeam2
Feature #4611: the resource command should tab complete starting from scripts/resource
Feature #4637: Add qemu support to the lab plugin
Feature #4660: New Module Submission: joomla_filter_order_aux.rb
Feature #4661: New Module Submission: joomla_16_admin_exec.rb
Feature #4662: Updated Module Submission: /auxiliary/scanner/http/vhost_scanner.rb
Feature #4880: New Module: PopPeeper INI Stack Overflow bug
Feature #4943: migrate shellcode before executing it
Feature #4983: Implement WMI payload delivery
Feature #5211: Post exploitation meterpreter script for local privilege elevation on windows
Feature #5315: include pcaprub in windows installer
Feature #5333: LifeSize Room Command Injection
Feature #5406: John the Ripper Oracle Password Cracker Fast Mode
Feature #5407: John the Ripper MS SQL Password Cracker Fast Mode
Feature #5408: John the Ripper MySql Password Cracker Fast Mode
Feature #5423: New module: Postgres MD5 Crack
Feature #5437: Auxiliary Module jtr_unshadow
Feature #5451: aux gather module for Shodan search engine
Feature #5454: Bash format for msfencode/msfvenom
Feature #5459: CVE-2006-5820 / AOL Superbuddy module
Feature #5479: 2 New Vsploit Modules - Syslog Spoofing Messages and FIles
Feature #5503: New post module 'myca'
Feature #5513: New Auxiliary Module: JtR Linux
Feature #5582: IMVU Password gather Module
Feature #5598: New Windows Post Module: Windows Gather Wireless Profile
Feature #5607: Process RC files with ERB
Feature #5609: Add original PoC author to the DTLS ChangeCipherSpec DoS Module
Feature #5621: GTA SA-MP Fileformat Exploit
Feature #5661: Add improved database query commands to msfconsole
Feature #5671: Need a strategy for figuring out dependencies for modules
Feature #5681: Modules should be clearer about their specific licenses.
Feature #5703: Portable Windows version
Feature #5809: Exploit for CVE-2010-0738, JBoss Application Server (AS) 4.0.x
Feature #5815: Exploit for CVE-2010-0738, JBoss Application Server (AS) 4.0.x
Feature #5820: phpLDAPadmin <= 1.2.1.1 (query_engine) Remote PHP Code Injection Module
Feature #5822: ROM-0 Scanner
Feature #5876: Viscom Software Movie Player Pro SDK ActiveX 6.8
Feature #5901: NJStar Communicator 3.00 MiniSMTP Server Remote Exploit
Feature #5933: Asterisk Bruteforce module
Feature #5950: dir_scanner / brute_dirs module overlap
Feature #5966: CorpWatch API integration for metasploit
Feature #6020: ftp_login module clutters up the DB with anonymous access entries from all usernames tried
Feature #6023: Implement CVE-2011-3544
Feature #6025: Check empty user/pass for owa_login.rb
Feature #6028: List plugins in the plugin tab
Feature #6029: CCMPlayer 1.5 Stack based Buffer Overflow
Feature #6030: Ability Server 2.34 STOR Command Stack Buffer Overflow
Feature #6035: Avid Media Composer 5.5 - Avid Phonetic Indexer Stack Overflow
Feature #6048: post module for printing privilege info on windows sessions
Feature #6051: KingView 6.5.3 KVWebSvr.dll ActiveX ValidateUser Buffer Overflow
Feature #6067: Exploit Module For Family Connections CMS 2.7.1 Remote Command Execution
Feature #6072: Patch For OSVDB 77455: Ipswitch TFTP Server Directory Traversal Vulnerability
Feature #6074: request for inclusion revised persistence post model
Feature #6080: description patch for post module win_privs.rb
Feature #6082: Traq <= 2.3 Authentication Bypass / Remote Code Execution Exploit module
Feature #6094: Auxiliary module for "CVE-2005-4832: Oracle Database Server Change Data Capture Component DBMS_CDC_SUBSCRIBE SUBSCRIPTION_NAME Parameter SQL Injection"
Feature #6103: PmWiki <= 2.2.34 (pagelist) Remote PHP Code Injection Exploit
Feature #6117: Windows Gather RazorSQL credentials
Feature #6125: OKI Hunter
Feature #6128: Add ability for railgun to reverse lookup constants (and error codes)
Feature #6129: Exploit module for "CVE-2011-4642: Splunk Remote Code Execution"
Feature #6130: lib/msf/core/post/windows/[registry.rb,services.rb] need a rewrite
Feature #6150: the lab_load_config command (of the lab plugin) should tab complete starting from data/lab
Feature #6151: Plone and Zope Remote Command Execution
Feature #6156: Nexpose plugin should allow for saved credentials
Feature #6168: Exploit Module for CoCSoft Stream Down 6.8.0 buffer over flow
Feature #6185: Search feature for db dispatcher commands (hosts etc)
Feature #6194: Drupal Users Enumeration - AUX Module
Feature #6207: Various edits + new target for CoDeSys webserver exploit module
Feature #6248: import DnsRecon XML
Feature #6267: 7-Technologies IGSS 9 IGSSdataServer.exe Denial of Service
Feature #6301: New Auxiliary Module: Ektron CMS400.NET Default Password Scanner
Feature #6307: Add vBSEO proc_deutf() PHP Code Injection Exploit
Feature #6331: Sunway ForceControl <= 6.1 sp3 SNMP NetDBServer.exe Stack Overflow

Metasploit 4.3.0

Due in about 4 months (06/01/2012)

75%

84 closed (73%)   31 open (27%)

Related issues
Feature #244: reload payloads with rexploit
Feature #500: Handle code duplication between fileformat, browser, and smtp mixins
Feature #588: [patch] HTTP server aux module for serving file format exploits
Feature #700: Meterpreter script to enumate USB storage registry entries
Feature #752: Reverse "Port-forwarding", i.e. bind on meterp server and tunnel back to attacker
Feature #1083: Brute force version of modules/auxiliary/scanner/oracle/xdb_sid.rb and patch for xdb_sid
Feature #1336: Added ability to set timeout on priv/hashdump
Feature #2975: Patch to add db_psexec_scanner
Feature #3060: Remote console to msfrpcd
Feature #3091: assimilate the powershell script from Nick
Feature #3499: compatible_sessions should also check Platform
Feature #3538: allow db_nmap to save output files
Feature #3597: script to "brute force" incognito user add on all sessions
Feature #3679: XML Data Package (XDP) format support for PDF exploits
Feature #3772: Improvement to Meterpreter script getgui
Feature #3826: IPv6 Persistence Meterpreter Script
Feature #3933: (Have Patch) - USB History - Post exploitation script to enumerate USB Drive History
Feature #4056: wmic post module
Feature #4137: Request extended channel I/O commands for meterpreter
Feature #4143: Download and Execute (via Ruby)
Feature #4159: Antiantimeter - A script to kill or mitigate from antimeter
Feature #4172: include support for snmp v3
Feature #4288: New windows/gather/Post Module enum_services.rb
Feature #4439: EAP-MD5 offline dictionary attack
Feature #4568: Traffic hijacking via HSRP - racket lib
Feature #4592: OSX vfork() reverse_tcp shellcode
Feature #4604: persistence-hostname.rb
Feature #4650: Module to kill Mcafee AV
Feature #4652: Post Modules should allow user to choose payload and location
Feature #4667: Bug #2105 Contribution by Bercegay
Feature #4694: new windows post module meterpreter_pizza_connection
Feature #4700: enum_opera - meterpreter script
Feature #4711: New Module Submission: DNS MITM
Feature #4712: New Module Submission: DHCP Exhaustion
Feature #4721: Meterpreter script update - virusscan_bypass8_8
Feature #4725: Exchange 2010 OWA Brute Force Module
Feature #4849: Redis Server Scanner
Feature #4929: Microsoft IIS FTP Server <= 7.0 LIST Stack Exhaustion Denial of Service
Feature #5118: Migrated service_manager.rb to Post Module
Feature #5205: New Post Module: unpriv_wmic
Feature #5210: New Post Module: Windows Gather SQL Credentials from McAfee ePO 4.6 Config
Feature #5217: New Modules: hp_printer_pjl_traversal & hp_printer_pjl_cmd
Feature #5218: New Post Module - enum_cred_store.rb
Feature #5270: Railgun - Proposing added functionality to Util for improved handling of structures for both data in and out
Feature #5271: 64 bit nasm_shell
Feature #5291: Need TFTP Client mixin
Feature #5332: Apache Tomcat Directiory Listing
Feature #5338: Add the ability for ruby blocks in rc files to share binding
Feature #5364: Typo3 AUX modules
Feature #5384: Oracle E-Business Suite SQL Injection 11.5.1-11.5.10.2
Feature #5398: AUX module to impersonate ssl certificate
Feature #5411: patch to webdav_internal_ip.rb to allow path to be specified
Feature #5412: webdav_scanner.rb and webdav_website_content.rb PATH patches
Feature #5428: Added support for Local File Inclusion to module php_include.rb
Feature #5442: Improved pattern creator
Feature #5447: file_stalker: post module for monitoring directories for files matching a glob or a regex
Feature #5455: Patch for smb_relay.rb to allow the share written to, to be defined in an option
Feature #5481: html report module
Feature #5482: Local Admin Search
Feature #5498: CVE-2011-3493 Cogent Datahub module
Feature #5514: Local Admin to Domain admin aux module
Feature #5541: SAP auxiliary modules - Phase 2
Feature #5580: Additional checks for the existing ssl.rb module
Feature #5592: CyTel Studio <= 9.0 CY3 Stack Buffer Overflow
Feature #5610: Remote unauthenticated root in ctek SkyRouter
Feature #5620: SAP ICM URLscan module
Feature #5680: new exploit: Free MP3 CD Ripper 1.1 Local Buffer Overflow
Feature #5682: phpScheduleIt PHP CVE-2008-6132
Feature #5742: SAP OSexecute Exploit module
Feature #5779: Ported exploit: Mini-Stream RM-MP3 Converter v3.1.2.1 (.pls) Stack Buffer Overflow universal
Feature #5797: Search environment for get_config_root
Feature #5803: Multicast DNS Collector Auxiliary
Feature #5810: fakedns.rb server does not support multiple targets
Feature #5855: [new module] zFTP Server "stat/cwd" Remote Denial-of-Service
Feature #5880: Try to create post module to loot KeePass
Feature #5882: Better DB2 support (grab hashes, cracking (JtR), sql_exec)
Feature #5946: AbsoluteFTP 1.9.6 - 2.2.10 Remote Buffer Overflow (LIST)
Feature #6004: smb_login scanner should have option to not report guest accounts
Feature #6005: Implement CVE-2011-4404 (VMWare dir traversal)
Feature #6014: Add thunderbird credential collector
Feature #6039: "jobs -v -v" to dump full datastore of running jobs
Feature #6076: 802.11n modules from JWright - fuzz_amsdu & fuzz_proberesp_11n
Feature #6165: pushd/popd-like functionality for msfconsole
Feature #6295: Radmin scanner
Feature #6305: Advanced/evasion options in table format
Feature #6343: [POSIX meterpreter] needs a 'make debug' target

Open Backlog

36%

76 closed (32%)   158 open (68%)

Related issues
Feature #181: Meterpreter-based discovery tools / port scanners
Feature #303: Add aux modules for MITM tasks (Arp spoof, sslstrip, iframe injection)
Feature #315: Exploit fragmentation for IPS evasion
Feature #326: Add autoproxy detection to payloads
Feature #332: sort and use gathered usernames/hashes in aux modules
Feature #387: Local Exploits
Feature #388: Add Domain / Workgroup / Computer Detection for PSEXEC and other SMB modules
Feature #389: Install via Token / PTH functionality for Meterpreter
Feature #390: Arpscan for Meterpreter
Feature #403: Binary (nix/win) building of modules (not just exploits)
Feature #406: Full Java Payload Support
Feature #411: Add netcat-like advanced features to CONNECT
Feature #417: Meterpreter 'mount' remote file system
Feature #420: Functional SMB file server required to implement some exploits
Feature #421: Utility to generate module templates for (exploit, auxiliary, payload, encoder, nop)
Feature #444: DNS Tunneling for Meterpreter and Multi/Handler
Feature #445: Standalone Meterpreter (non-staged)
Feature #498: back command should work like popd
Feature #499: Move mixins into the modules directory, allow exploits to derive from a base template
Feature #528: SSL Strip for Meterpreter
Feature #595: statistics for browser_autopwn
Feature #598: create some wuftpd exploits
Feature #603: Provide better wrapping in msfconsole
Feature #653: several auxillary modules should probably be exploits instead
Feature #654: Windows 'cmd' stagers required
Feature #661: Metepreter should have a config file for loading aliases
Feature #679: Update screenshot plugin to work on sessions in parallel
Feature #710: Expose meterpreter sessions as WebDAV service
Feature #712: Update the token hunter to work on sessions in parallel
Feature #718: Enumerate wireless interfaces and show nearby APs
Feature #724: Update RbMysql to allow old-style password hashing (LONG_PASSWORD=0)
Feature #755: Shadow Copy / Restore Point File reader
Feature #759: Meterpreter User and Group List
Feature #760: Meterpreter Clipboard Access
Feature #765: OpenOffice Basic equivalent to MS Office VBA Payloads
Feature #810: a printer driver to load dll in kernel mode ala "print a shell" in hackin9
Feature #816: Create user enumeration modules for PostgreSQL
Feature #954: Support UPnP and/or STUN
Feature #959: Extend adobe_pdf_embedded_exe to work on multiple pdf viewers
Feature #1070: token hunter continue from session x
Feature #1205: meterpreter unix functions
Feature #1289: Obtain VNC PW from Registry via Meterpreter
Feature #1357: Get passwords with meterpreter
Feature #1474: Notification when Jobs quit
Feature #1487: LDAP Enumeration Module
Feature #1536: exploit debugging features need a serious overhaul
Feature #1712: Create a module for TikiWiki 1.9.8.1 graph_formula vuln
Feature #1787: Infecting *.wma and *.wmv file
Feature #1801: dir_listing.rb (<title>#{ip} - /</title>)
Feature #1815: Import the Nmap services db to enable --top-ports port specification option in auxiliary port scanners
Feature #1832: Proposal of some commands for walking through the filesystem
Feature #1913: Update SIP enumerator.rb to support TCP and SSL (sips)
Feature #1978: ability to delete hosts/ports/notes in the database needs to be exposed
Feature #2029: msfopcode database needs to be updated
Feature #2056: Match output of db_services to nmap.
Feature #2057: New payloads or payload customization for AV evasion?
Feature #2087: Meterpreter should allow showing full command line of running processes
Feature #2090: add Date Added column to module table
Feature #2092: Meterpreter download maximum file size
Feature #2097: Sessions command should be more user-friendly
Feature #2104: Add "missing" features from meta-phish to exploit/multi/browser/java_signed_applet
Feature #2121: Hashdump backgrouding
Feature #2122: Metsvc Encoding
Feature #2127: include esser's php post-exploitation stuff in php meterpreter
Feature #2175: support for grabbing cached passwords on windows
Feature #2214: import common windows error codes into metasploit
Feature #2228: integrate Sven Taute's JSidle JS encoder
Feature #2306: ARM payload - Linux Execute Command
Feature #2455: allow returning to a running job's module context
Feature #2480: Addition of the Alpha3 Encoder
Feature #2543: Enhance SEH mixin to support commonly used techniques
Feature #2853: dir_scanner should differentiate between 404 and 301 redirect
Feature #2862: Implement win32 DEP bypass routine inside egg hunter
Feature #2985: update additional exploits modules with reworked http file uploads
Feature #2989: Egghunter should use separate encoder invocation from payload
Feature #2995: Adding XSSF to Metasploit Framework
Feature #2996: Ensure meterpreter and shell scripts report_cred when they're dealing with usernames and passwords
Feature #3140: the framework should provide facilities for conducting automatic target detection
Feature #3181: allow retries for authentication brute force failures
Feature #3182: VNC/RFB: detect view-only sessions when establishing a session
Feature #3218: Create a more coherent way to specify various host/ports
Feature #3261: [cisco] TTL Expiry Attack
Feature #3294: Implement AddedDate and UpdatedDate for modules
Feature #3345: Cisco IOS configuration grabber via SNMP
Feature #3377: Convert meterpreter scripts to Module format
Feature #3381: Improving Lotus Domino Password Hash Collector
Feature #3458: Replace OptPath with OptReadFile and OptWriteFile
Feature #3563: More exploits should record a BufferRegister and/or additional trigger context
Feature #3585: MS08-067 exploit will not work against machines with /NoExecute=AlwaysOn
Feature #3638: New Module - Slow HTTP POST Denial Of Service
Feature #3677: Support post modules that can create sessions via a mixin
Feature #3702: SIP digest leak - exploit module
Feature #3983: Extend VNC library
Feature #4028: Egghunters should have optional support for VirtualAlloc/mprotect
Feature #4067: SpoonFTP <= 1.2 RETR Denial Of Service
Feature #4202: cdecl railgun calls
Feature #4579: SMB Mixin should have SMB2 support
Feature #4582: Mimic StackAdjustment in msfvenom
Feature #4668: Add ESXi suppor to the lab plugin
Feature #4832: CVE-2011-1290 Metasploit Exploit Bounty
Feature #4905: Make meterpreter capabilities queryable
Feature #5227: New module: Solar FTP 2.1.1 PASV Command Buffer Overflow
Feature #5471: KnFTP 1.0.0 Server Remote Buffer Overflow
Feature #5637: Opera Browser 10/11/12 (SVG layout) Memory Corruption
Feature #5921: windows generic arbitrary code execution (using hta/html) module
Feature #5967: Transparent Proxy && Inject HTML/JAVASCRIPT
Feature #6078: DameWare Mini Remote Control Client Agent Service bof
Feature #6089: Exploit module for CVE-2006-0272: Oracle Database XDB.DBMS_XMLSCHEMA.GENERATESCHEMA Buffer Overflow Vulnerability
Feature #6090: Exploit module for CVE-2004-1774: Oracle Database MDSYS.MD2.SDO_CODE_SIZE Buffer Overflow Vulnerability
Feature #6105: Java Post Modules