Metasploit 3.7 released
Metasploit, the open source penetration testing solution, just reached version 3.7.
Metasploit users will notice an immediate improvement in product response time. Customers with large enterprise networks will be happy to note that the commercial product can easily scale to thousands of hosts within a single project.
The Data Import backend has undergone a rewrite, speeding up most import tasks by a factor of four. Metasploit Pro users will note that shell sessions can now be accessed by multiple users at a time. This allows an entire team to collaborate on the post-exploitation process and can be used as a training aid for junior analysts.
This release adds support for SMB Signing, enabling pass-the-hash and stolen password attacks against Windows 2008 Server environments. In addition to these improvements, this release adds 67 new modules consisting of 35 exploits, 17 post-exploitation modules, and 15 auxiliary modules.
Highlights from the new modules include:
- Apple iOS Backup File Extraction: Extract sensitive data from iTunes backup files (location, call history, SMS content, pictures, etc).
- Exploits for two different Adobe Flash vulnerabilities exploited in the wild.
- Code execution modules for MySQL and PostgreSQL when a valid login is available.
- Exploit for the Accellion File Transfer Appliance Default Encryption Key flaw found by Rapid7.
- Over ten new exploits for HP Network Node Manager (plus an HP OpenView exploit).
- Post-exploitation module for privilege escalation through the .NET Optimizer Service.