Spencer McIntyre

Views are my own.

[CryptoCat @_CryptoCat]

Found an unpatched RCE in Gogs 👀 Any authenticated user can get code execution on the server through argument injection into git rebase. Full @rapid7 writeup + @metasploit module available now!

🔗https://t.co/VAYLxZ6o1b

[scriptjunkie (Matt) @scriptjunkie1]

I appreciate everyone dropping linux privesc 0days in the current AI renaissance, but to really make it feel like the good ol days someone needs to drop a weaponized pre-auth SMB or RDP RCE. We haven't had a good Windows worm in AGES.

[Spencer McIntyre @zeroSteiner]

@_RastaMouse @metasploit The Block API then changed to use the Length field instead of MaximumLength so it wouldn't be tricked into using a planted value in memory.
We'd occassionally get reports of what was fundamentally the same issue e.g. https://t.co/UqBqGkirID 2/2

[Spencer McIntyre @zeroSteiner]

FWIW, @metasploit made an update to how ror13 hashes are calculated for the first time in (I think?) over a decade to address some limitations in the block API we were running into.

[Rasta Mouse @_RastaMouse]

Created a small .NET tool for ROR13 hashing that you can install to add a global command to cmd/pwsh. It's a lifesaver if you just need some quick hashes.

[Spencer McIntyre @zeroSteiner]

@_RastaMouse @metasploit The ROR13 calculation was switched to use an "IV" of 0 by default, and the module name hash is used as the IV when calculating the function name hash. Framework now randomizes the IV at assembly time so the ROR13 hashes aren't hard-coded anymore 1/2

[CryptoCat @_CryptoCat]

Coming soon to a @metasploit near you 👀

[Metasploit Project @metasploit]

Catch this episode of Hacktics and Telemetry on Youtube, featuring our very own @zeroSteiner talking about the Metasploit MCP!

https://t.co/Sq8azNqWJD

[Nicolas Krassas @Dinosn]

Active Directory Exploitation with Metasploit https://t.co/7voHc9C0Z6

[Metasploit Project @metasploit]

This weeks wrap up is packed with new stuff including an MCP server, and new modules for relaying NTLM from HTTP to LDAP and a Copy Fail exploit with x64 and AARCH64 support https://t.co/ymF91y5pxA

[Metasploit Project @metasploit]

The annual wrap-up for Metasploit Framework is out now, and it includes the entirety of stats for 2025. This wrap-up and its contents would not be possible without the participation and dedication of our contributors and researchers, and all of our thanks goes to them! Metasploit Framework wouldn't be the same without you, thank you. https://t.co/guhMFZSxfW

[ʞʞıdɐɔoɥƆ @Chocapikk_]

From Zero to Shell: Hunting Critical Vulnerabilities in AVideo

https://t.co/pShNsxoMSR

[Spencer McIntyre @zeroSteiner]

New NTLM relay dropped for MSSQL. Should see some SCCM modules to use it next. @unsigned_sh0rt gave me all kinds of ideas.

[Metasploit Project @metasploit]

This week's wrap-up has some pretty rad MSSQL updates and a module for React2shell. Get it here: https://t.co/diw05fZ4y9

[🕳 @sekurlsa_pw]

Metasploit also has a merged exploit with check for react2shell.

⌨️ module:
multi/http/react2shell_cve_2025_55182

📦 Dockerfile to test available in:
Data\exploits\react2shell_unauth_rce_cve_2025_55102

https://t.co/B9cwDsj9ph

[ʞʞıdɐɔoɥƆ @Chocapikk_]

New Metasploit module for CVE-2025-54236 (SessionReaper) - Unauthenticated RCE in Magento

https://t.co/mR8mSe1BSw

[_leon_jacobs(💥) @leonjza]

I've been hacking on a new Windows Named Pipe tool called PipeTap which helps analyse named pipe communications. Born out of necessity while doing some vulnerability research on a target, its been super useful in reversing it's fairly complex protocol. :)

[Stephen Fewer @stephenfewer]

Come join @rapid7! I’m hiring for a Senior Security Researcher to join our team. You'll get to work on n-day analysis, zero-day research, exploit development, and more - focusing on enterprise software and appliances. Fully remote in the UK, details here: https://t.co/WpUxk5nqjI

[Stephen Fewer @stephenfewer]

Today @rapid7 is disclosing 8 new printer vulnerabilities affecting 742 models across 4 vendors. After 13 months of coordinated disclosure with Brother Industries, Ltd, we're detailing all issues including a critical auth bypass. Full details here: https://t.co/zvWDK8ab3s

[Stephen Fewer @stephenfewer]

Our @metasploit auxiliary module for the new Brother auth bypass is available. The module will leak a serial number via HTTP/HTTPS/IPP (CVE-2024-51977), SNMP, or PJL, generate the devices default admin password (CVE-2024-51978) and then validate the creds: https://t.co/3uJG56aMx9

[Stephen Fewer @stephenfewer]

Today @rapid7 disclosed two vulns affecting NetScaler Console and NetScaler SDX, found by Senior Security Researcher Calum Hutton! 🎉 Our blog details the authenticated arbitrary file read vuln (CVE-2025-4365), and the authenticated arbitrary file write vuln (Which the vendor has not assigned a CVE for).