~~~~~~~~~~~~~~~~
version 5.0.1
~~~~~~~~~~~~~~~~
* added a create set directory if not found in the initial launch of se-toolkit or set
* added a create for the set logfile when launching se-toolkit
* fixed a bug that would cause ratte to not properly load when executing
* fixed a bug that would cause the SET HTTP server to not work properly
* added default path for the pwnie express folks for /opt/metasploit-framework
~~~~~~~~~~~~~~~~
version 5.0
~~~~~~~~~~~~~~~~
* fixed a bug that would cause tabnabbing to throw an exceptions around check_options
* added setcore modules into tabnabbing to allow centralized routines
* fixed a bug that would cause webjacking to throw an exeptions around check_options
* added git clean -fd prior to set update, this will force a clean when pulling the latest files
* fixed a bug that would cause a system not setup properly when installing in setup.py
* fixed a bug on start_dns() upon launch will cause errors on certain systems
* added installation script for putting SET into /usr/bin and /usr/share for FSH compliant installer
* added set-update to the installation path, can type that anywhere now
* added set-automate to the list to be typed in anywhere
* fixed a bug that would cause the java applet method to not work a second time in use (reload)
* rewrote MASSIVE amounts of code to no longer use src/program_junk for storage of applications, its now all under ~./set
* fixed a os.chdir issue when using it to spawn a web server during java applet, moved to multi processing instead of threading.thread
* fixed a bug that caused credential harvester to throw an exceptions with the new ~./.set directory structure
* centralized setdir into the main repository to handle it through there and to call the ~/.set directory
* added additional passwords to wordlist.txt used for fast-track mssql brute forcing
* fixed a mssql access bug that would cause fast-track to error out if unspecified IP was added
* removed the pymssql check from the initial SET start and onto Fast-Track since it's only used there
* turned java repeater to ON by default, much better success rate in SE pentesting
* rewrote large portions of payloadgen to incorporate the changes to the new ~/.set path variables
* added a new file structure to launch set called se-toolkit. The set executable is now depricated and should no longer be used - to launch set just type ./se-toolkit
* updated the setup.py installation to be more robust when performing installations (windows, etc.)
* moved all of the reporting structures within SET to the new ~/.set directory
* added a checkup routine in set and se-toolkit to check for the reports directory
* fixed a bug that would cause multi powershell injection to trigger even when using the powershell menu, it will just generate one now
* fixed an issue that could cause powershell injection to not work properly using the fast patch method
* fixed an issue that would cause definepath to not be specified when using the SE Toolkit Interactive shell
* fixed relative path issues in sccm_main and powershell teensy vectors to point to new .set directory
* fixed an issue that would cause the SE toolkit to hang on a weird bug when importing binascii - moved binascii to main import above and no longer hung
* fixed a before assignment error when using the windows debug conversion in the fast-track mssql menu (meta_path reference)
* changed reports directory within the teensy side to move to ~/.set/reports
* moved the report_generator in harvester to pull and report on the new ~/.set reports structure
* fixed an issue where webjacking would not post properly on certain websites (index2.html conflict issue)
* added the Metasploit MS13-009-IE SLayoutrun Use After Free Exploit to the Metasploit Brwoser Exploit attacks
* fixed a parsing issue with the JMX bean exploit in the SET menu text from appearing to be on one line
* added a new description on setting up sendmail for Kali Linux
* added a check for multi powershell injection and check for solo instances through powershell teensy and not to generate a ton
* changed the email handler from control-c to END instead. Control-C will break multiprocessing within src.html.spawn and this is the proper way to do it
* cleaned up setcore with old code and optimized other areas of the code base
* reduced the description of the allports payload when selecting in web attack method
* added a completely new and redesigned multi threaded and multiprocessing web server - should be significantly faster with less bugs and crashing when handling non-rfc compliant HTTP requests
* optimized applet load time to be much more efficent when being loaded into the web attack vector (about 4 seconds improvement)
* rewrote exceptions handler for the new web server to check to see if anything is running on port 80 when starting
* turned java repeater to on by default - more stable and tested on multiple platforms
* fixed an issue that would cause the java applet web cloner to fail upon running it twice - added reload(module) option to fix the bug
* fixed an issue that caused powershell.prep to not load if used twice
* fixed an import error when using powershell injection through the main menu
* changed initial set menu in powershell to be the standard setprompt
* changed the default port to 443 on powershell delivery in the set option number 10
* fixed an issue that would cause the powershell injection to spawn on port 22 versus 443 as specified
* removed the man left in the middle attack - no longer in use, outdated and not maintained
* removed beautifulsoup as a dependancy for SET due to the removal of man left in the middle
* added the ability to call the web server and stop it based on stop_server()
~~~~~~~~~~~~~~~~
version 4.7.2
~~~~~~~~~~~~~~~~
* fixed an issue where UPX would trigger even if not properly installed
* fixed an issue that would cause a shellcode_ports exception to be found on multi-pyinjector - should have read shellcode_port
* added an additional check in for upx coding when generating binaries
* fixed an issue where creating a single payload without an attack would not found the proper rc file within SET
* fixed an issue where selecting multi pyinjector would not find the proper meta_config rc file
* turned upx to off by default on the set configuration file
* incorporated a change to remove several lines of code by removing a loop and inserting null bytes by using utf_16_le as the return. Thanks ethack for the post.
* fixed an issue when exiting SET and the DNS server was set to ON, it would not properly exit
* added the most recent version of rid_enum which is at version 0.5
* fixed an issue where loading fast-track would throw an error message
* turned exception handing back on in the set root
* added new binary blobs to evade AV
* changed the language and added git to the setup.py file
~~~~~~~~~~~~~~~~
version 4.7.1
~~~~~~~~~~~~~~~~
* added rid_enum into the fasttrack menu - no modifications needed to the file itself and built into SET logic (will always maintain most recent git version)
* cleaned up old code in create_payload.py, instead of iterative loops, it now uses core module check_config for core variables
* fixed a bug that would cause auto_migrate to not work if multi_powershell injection was enabled
* fixed a unc_embed variable mismatch when turning unc_embed to on
* added dynamic patching of metasploit shellcode which allows certain payloads to not have to generate shellcode with msfvenom each time (very fast generation)
* standardized metasploit_shellcode to a setcore library and now being used by create_payload.py and powershell/prep.py
* added additional standard ports to the powershell_injection since its much faster to generate now.
* added a new config option called DNS_SERVER which allows you to configure SET as a DNS server and hae all traffic route through it. Just turn it on and you have a full fledged DNS server running.
* fixed indentiation of all python files to standard 4 spaces using reindent.py (thanks Siarc)
~~~~~~~~~~~~~~~~
version 4.7
~~~~~~~~~~~~~~~~
* removed a prompt that would come up when using the powershell injection technique, port.options is now written in prep.py versus a second prompt with information that was already provided
* began an extremely large project of centralizing the SET config file by moving all of the options to the set.options file under src/program_junk
* moved all port.options to the central routine file set.options
* moved all ipaddr.file to the central routine file set.options
* changed spacing on when launching the SET web server
* changed the wording to reflect what operating systems this was tested on versus browsers
* removed an un-needed print option1 within smtp_web that was reflecting a message back to user
* added the updated java bean jmx exploit that was updated in Metasploit
* added ability to specify a username list for the SQL brute forcing, can either specify sa, other usernames, or a filename with usernames in it
* added new feature called multi-powershell-injection - configurable in the set config options, allows you to use powershell to do multiple injection points and ports. Useful in egress situations where you don't know which port will be allowed outbound.
* enabled multi-pyinjection through java applet attack vector, it is configured through set config
* removed check for static powershell commands, will load regardless - if not installed user will not know regardless - better if path variables aren't the same
* fixed a bug that would cause linux and osx payloads to be selected even when disabled
* fixed a bug that would cause the meta_config file to be empty if selecting powershell injection
* added automatic check for Kali Linux to detect the default moved Metasploit path
* removed a tail comma from the new multi injector which was causing it to error out
* added new core routine check_ports(filename, ports) which will do a compare to see if a file already contains a metasploit LPORT (removes duplicates)
* added new check to remove duplicates into multi powershell injection
* made the new powershell injection technique compliant with the multi pyinjector - both payloads work together now
* added encrypted and obfsucated jar files to SET, will automatically push new repos to git everyday.
* rewrote the java jar file to handle multiple powershell alphanumeric shellcode points injected into applet.
* added signed and unsigned jar files to the java applet attack vector
* removed create_payload.py from saving files in src/html and instead in the proper folders src/program_junk
* fixed a payload duplication issue in create_payload.py, will now check to see if port is there
* removed a pefile check unless backdoored executable is in use
* turned digital signature stealing from a pefile to off in the set_config file
* converted all src/html/msf.exe to src/program_junk/ and fixed an issue where the applet would not load properly
~~~~~~~~~~~~~~~~
version 4.4.5
~~~~~~~~~~~~~~~~
* fixed a bug that would cause the reports directory to not be active
* converted migrate -f to post/windows/manage/smart_migrate
* removed prompt when using java applet and to prompt for Apache, it will auto start if it can and its flagged
* Bug fix for an EOFError when using track emailing
* Fixed a bug that would cause SET to exit if Apache was in a restart mode
* Fixed a bug that would not define web_port when using Apache mode
~~~~~~~~~~~~~~~~
version 4.4.4
~~~~~~~~~~~~~~~~
* fixed a powershell bug that would cause an error if not specifying port 443
* added an additional prompt if generating the powershell shellcode alphanumeric injection through the menu and not through java applet
~~~~~~~~~~~~~~~~
version 4.4.3
~~~~~~~~~~~~~~~~
* Fixed a pycrypto bug that would cause SET to error out if pycrypto was not properly installed
* Fixed a bug that would cause the alphanumeric shellcode injector to error out when selecting it through the payload menu (port.options exception)
~~~~~~~~~~~~~~~~
version 4.4.2
~~~~~~~~~~~~~~~~
* Added ability to use UNC_EMBED within any of the webattacks that use site cloner
* Added newer version of airbase-ng and airmon-ng from the aircrack repository
~~~~~~~~~~~~~~~~
version 4.4.1
~~~~~~~~~~~~~~~~
* Recompiled Java Applet to include netsh advfirewall set global StatefulFTP disable upon detection of windows operating systems (windows 7/8 specifically). This will only work if user has administrator level priv but does not trigger UAC prompt. If this is set to enabled, Metasploit payloads will directly fail on port 21.
* Fixed a bug when the reports directory would not be created within qrcode generation
~~~~~~~~~~~~~~~~
version 4.4
~~~~~~~~~~~~~~~
* Added new folder structure under src/webattack/java_applet - this includes again the source code of the Java Applet.
* Added compile program for making applets in the java_applet directory.
* Recompliled the Java Applet to add better obfsucation.
* Edited payloadgen to utilize more base64 encoded techniques.
* Added better stability to the multi injector payload when ports are not found
* Added new core library that called EncryptAES which allows you to encrypt specific string data
* Added obfsucation into the Java Applet and placed new params to pull
* Rewrote multipyinjector for better error handling and performance
* Added AES 256 encryption to the multi-pyinjector - before it would write out the shellcode to tmp files, instead it encrypts the entire data via 256 aes then pulls via command line and does not write out the files
* Added ability for SET and Java Applet to handle multi-pyinjector AES encrypted payloads through the pycrypto modules
* Modified the payload creation to encrypt payloads on the fly with a randomized cipher key exchange - each new payload generated will be a completely different AES cipher key
* Fixed a bug that would cause powershell to not fire properly when using multi-pyinjector. It now prompts for an additional port and appends it to the meta_config_multi_pyinjector answer file for metasploit
* Fixed a bug that would cause pyinjector to not properly execucute when not using powershell injection
* Updated the Java Applet to include the new multi pyinjectir cipher key addition once executed
* New encrypted binary multi pyinjector in place
* Added time delay between firing multiple payloads. When executing multiple instances stdapi.rb freaked out and wouldn't load. This didn't hinder the shell but you would manually need to add the lib in order to get the standard libraries within meterpreter. This has since been fixed.
* Large redesign of multi-pyinjector which is now streamlined to be as effecient as possible
* Added better checking for multi pyinjector when using powershell to add new detections around port.options
~~~~~~~~~~~~~~~~
version 4.3.10
~~~~~~~~~~~~~~~~
* Fixed a bug that would cause README to error out (thanks Chris Barrow).
* Added the ability to use hostnames with payloads including pyinjector and multiinjector
* Added better handling of hostnames when not specifying an IP address
* Added better handling around if an IP address is typed in wrong on web cloning
* Updated wording in setcore to reflect version 4.3.10
~~~~~~~~~~~~~~~~
version 4.3.9
~~~~~~~~~~~~~~~~
* Removed a bug that would state the create and import certificate was under development. This was old from when web victim profiler was removed.
* Fixed the new java exploit exploit/multi/browser/java_jre17_jmxbean to use java/meterpreter/reverse_tcp since it is a java exploit versus traditional payloads
* Added auto_redirect as an option by default in the set_config
~~~~~~~~~~~~~~~~
version 4.3.8
~~~~~~~~~~~~~~~~
* Fixed a bug when using multiattack with the harvester and metasploit exploits only. It would throw an error that index.html.new was not found. This has been fixed.
* Removed the web victim profiler from the web attack menus, this has not been added and is not in the current roadmap for completion.
~~~~~~~~~~~~~~~~
version 4.3.7
~~~~~~~~~~~~~~~~
* Added the new Java JMX bean zero day from Metasploit (exploit/multi/browser/java_jre17_jmxbean)
~~~~~~~~~~~~~~~~
version 4.3.6
~~~~~~~~~~~~~~~~
* you can now use up arrows, down errors, history, etc. within the interactive shell (thanks lnxg33k for the change)
* fixed a bug in OSX if README and readme were in the same folder, would throw errors (thanks mubix)
~~~~~~~~~~~~~~~~
version 4.3.5
~~~~~~~~~~~~~~~~
* added reverse command shell as an option in multiattack
* added ability when using webattack to set FROM: field when using webattack_email
* added better handling around when an email gets sent out and timeouts
* added a timeout flag in config that allows you to specify a timeout incase its moving to fast
* added randomness in timea swhen sending emails out to help remove spam filters from suspecting something
* added FROM NAME field in the client attack vectors used for the phishing menus
~~~~~~~~~~~~~~~~
version 4.3.4
~~~~~~~~~~~~~~~~
* converted SET over to github
* updated update_set() core library for git
* added an installer script for OSX in setup.py (thanks Wim Remes)
* fixed a bug in the menu system in powershell attack vectors. menu 99 wouldn't exit properly (thanks f8lerror)
* fixed a new bug that was introduced when README was moved from readme/README (thanks f8lerror)
* fixed a bug in the naming scheme for the new zero day ie
~~~~~~~~~~~~~~~~
version 4.3.3
~~~~~~~~~~~~~~~~
* Added the new Metasploit IE zero-day Microsoft Internet Explorer CDwnBindInfo Object Use-After-Free Vulnerability to SET
~~~~~~~~~~~~~~~~
version 4.3.2
~~~~~~~~~~~~~~~~
* Added a check to see if a user inserted the right query string parameter in the new track user feature
* Added a string replace in the event the user puts in a .html instead of a .php, will automatically rename to .php
* Added better description handling around the track email in smtp_web with bold colors and easier descriptions on what to do
~~~~~~~~~~~~~~~~
version 4.3.1
~~~~~~~~~~~~~~~~
* Fixed a bug that would cause the imported executable in web attack vectors to download but not execute
* Cleaned up the Java Applet code and made the codebase significantly smaller
* Made a change to the track user emails that removes a step that was un-needed and removes an additional prompt
* Added faster multi-injector binary - should execute payloads much faster now
* Added new compiled Java Applet with better obfuscation
~~~~~~~~~~~~~~~~
version 4.3
~~~~~~~~~~~~~~~~
* Added print statements to exporting powershell injection attacks. When using the powershell attacks it will tell you the location of the file
* Removed the autorun script for enumeration on OSX, seems to break the host now
* Added new set routine metasploit_shellcode which has predefined built meterpreter payloads, this will completely speed up the generation time on pyinjector
* Added new set routine called shellcode_replace which will dynamically create IP addresses and port from the shellcode
* PyInjector now no longer needs to dynamically create shellcode through msfvenom, the shellcode is now pregenerated and dynamically created on the fly speeding up payload delivery by at least 40 seconds.
* Increased the powershell injection creation time by adding the new creation routine that has predefined payloads already generated via shellcode then dynamically changes the shellcode on the fly
* Stablized and added more meterpreter payloads so that you have a choice between https, reverse_tcp, http, and allports.
* Recompiled the pyinjector payloads and encrypted / packed with anti-debuggers
* Recompiled shellcodeexec payload and encrypted / packed with anti-debuggers
* Added a backup path for the credential harvester for the raw logs under src/logs/harvester.logs. In case theres an issue with the harvester not reporting back the findings you can find the log in the backup directory under the src/logs/harvester.log
* Added a pause delay in the fast-track MSSQL attack vector in order for sluggish systems to catch up with the payload delivery system
* Removed a stale __init__.py file that wasn't needed in the SET root directory
* Fixed a bug that would cause the authentication piece for open relays without password authentication to fail (thanks Jeremy)
* Cleaned up the smtp_web code and added more comments into the file
* Re-issued the SET self signed certificate for Java Applet it was expired
* Cleaned up code in the Java Applet and obfuscated the code again
* Added check for wget, if installed it will clone better otherwise it will use urllib2
* Added a new OSX/LINUX deploy binaries, you can turn this on and off in the config if you don't want to generate OSX / Linux payloads. By default it will now remain off, it makes the load time to generate things significantly faster.
* Fixed a bug where pyinjector would die and cause a loop on victim machine if closed improperly
* Added brand new payload called MultiPyInjector which will inject multiple payloads into memory. You can dynamically add this now through the Java Applet attack vector and select as many payloads as you want.
* Fixed a bug with the multipyinjector that would cause certain areas to error out on specified port.
* Fixed a patching bug for port 21 where patching the shellcode caused an error message.
* Encrypted and packed the multi-pyinjector payload and added anti-debugger technology.
* Added the ability to dynamically patch Metasploit payloads for the MultiPyInjector new payload. Uses the same as PyInjector now
* Added new config option called TRACK_EMAIL_ADDRESSES=ON/oFF which will now allow you through web attack vectors to track email addresses through SET. When you send out a large phish, the email address will be base64 encoded in the URL you specify within the toolkit. You will be prompted to insert where in the menu you want, for example say http://www.trustedsec.com was your normal phish link. You would specify http://www.trustedsec.com?INSERTUSERHERE. SET will then replace just the INSERTUSERHERE with the TO field of each victim which will be base64 encoded. Once clicked, SET will then handle the requests and let you know the user that clicked on each one in order to track.
* Cleaned up the code in the smtp_web and made it more readable for the mail function. Needed to be done while adding the TRACK_EMAIL_ADDRESSES
* Fixed a bug that would cause the WEBATTACK_EMAIL to fail when using the credential harvester
* Added track email addresses to harvester and java applet attack vectors when TRACK_EMAIL_USERS is specified
* Added base 64 handling to credential harvester and directly into a index.php versus index.html - needed in order to execute php code
* Tested the new track email addresses with credential harvester and made it track if track_email is on to automatically kick in apache server mode and webattack email without having to specify in the config
* Tested the new track email with java applet and made it track if track_email is on to automatically trigger WEBATTACK_EMAIL and APACHE_SERVER to automatically set to ON
* Converted old code from legacy times around checking config files to check_config through src/core/setcore routines
* Tested SET 4.3 on Windows 8 fully patched on the various different attacks, everything appears to be working as anticipated. Powershell injection is also working properly now with minor modifications.
* Added a check within Java Applet to automatically disable Apache if it is already started
* Fixed a bug that caused import payloads to throw an invalid payload option (thanks Tyler)
~~~~~~~~~~~~~~~~
version 4.2.1
~~~~~~~~~~~~~~~~
* Fixed the Java Repeater - had to rewrite some portions in order to use separate_jvm and caching in order to work.
~~~~~~~~~~~~~~~~
version 4.2
~~~~~~~~~~~~~~~~
* Improved Java Applet performance when executing
* Added additional payloads and encrypted formated for bypassing security mechanisms
* Fixed a bug in applet when used on older operating systems
* Fixed a lockup issue within the applet
* Used process builder for the back-end running of commands in Java Applet, adds new functionality and better performance without hangs
* Coverted all windows based java applet background processes to ProcessBuilder in java for better speed
* Removed AUTO_MIGRATE=ON by default, this ruins bypassuac - need to do more research, may be able to process ride to explorer.exe instead versus notepad.exe
* Added additional virtualization for pe files to SET payloads
~~~~~~~~~~~~~~~~
version 4.1.4
~~~~~~~~~~~~~~~~
* fixed a bug that would cause the dell drac scanner to not work properly
~~~~~~~~~~~~~~~~
version 4.1.3
~~~~~~~~~~~~~~~~
* Added multiple checks when importing file, no longer exits the entire application
~~~~~~~~~~~~~~~~
version 4.1.2
~~~~~~~~~~~~~~~~
* Added the ability to copy just a single file on custom imports or the entire folder when selecting site import on Java Applet
* Added ability to detect index.html automatically if the file is specified
* Added better handling if a folder doesn't end with a forward slash, it performs slashes checks and appends as needed
* Added ability to better detect index.html files when appended at the end
* Added more obfsucation and encryption to the pyinjector payload
* Added an additional check if apache is started with APACHE_SERVER turned to off. Will automatically prompt to shut it off for you
~~~~~~~~~~~~~~~~
version 4.1.1
~~~~~~~~~~~~~~~~
* Added automatic detection of apache on or off during credential harvester
* Added prompt to turn apache on automatically
* Added ability to use payloadgen infectious media with pyinjector and shellcodeinject
~~~~~~~~~~~~~~~~
version 4.1
~~~~~~~~~~~~~~~~
* Removed the Java Exploit from being built into the Java Applet. Being detected by to many AV vendors.
* Added core libraries to the scraper, needed for check_config and apache mode checks
* Added check for apache mode within harvester, will move new php customize script to apache directory and extract under different directory
* Rewrote new check mechanism in scraper for config checks and cleaned up code
* Fixed a bug that would cause the verified signature import to error out when selecting number 9 in the web attack menu
* Added a custom php script into harvester that allows you to check harvested credentials through apache
* Added compatibility with multiattack and apache mode for credential harvester and java applet combined
* Fixed the allports payload, really buggy at first with powershell injection, got it more stable
* Added better stability for the credential harvester to handle exceptions when being passed certain pieces of data including null connections
* Added better stability on the multiattack credential harvester php and applet attack
* Fixed a bug that would cause payload selection to not work correctly when using pyInjector
* Added so the peensy attack will prompt for an IP address and rewrite the pde file for the appropriate IP addresses
* Added datetime on teensy devices so they don't overwrite the teensy.pde files anymore
* Added better encoding into the java applet attack vector
* Added better packing and encryption on the pyinjector attack, loads super fast now when executing applet
* Added better reliability in the Java Applet
* Even more improved load times for the Java Applet and executable execution
* Added anti debugger and encryption to the initial staged downloader which is used for fast loading of payloads
~~~~~~~~~~~~~~~~
version 4.0.4
~~~~~~~~~~~~~~~~
* Added multithreading to credential harvester and better error handling
* Added allports payload for shellcodeexec and pyinjector
~~~~~~~~~~~~~~~~
version 4.0.3
~~~~~~~~~~~~~~~~
* Added copyfile(src, dst) core routine and fixed its original src copy path
* Changed copyfile to include folders and files
* Removed some old print statements
~~~~~~~~~~~~~~~~
version 4.0.2
~~~~~~~~~~~~~~~~
* Bug fix with the multiattack and importing custom web pages - would throw an exceptions error, this has been resolved
* Bug fix that would cause multiattack to not work with credential harvester and java applet
~~~~~~~~~~~~~~~~
version 4.0.1
~~~~~~~~~~~~~~~~
* small bug fix that caused payloads to throw an exceptions when selecting normal executables
~~~~~~~~~~~~~~~~
version 4.0
~~~~~~~~~~~~~~~~
* added a new attack vector to SET called the Dell Drac attack vector under the Fast-Track menu.
* Optimized the new attack vector into SET with standard core libraries
* Added the source code for pyinjector to the set payloads
* Added an optimized and obfuscated binary for pyinjector to the set payloads
* Restructured menu systems to support new pyinjector payload for Java Applet Attack
* Added new option to SET Java Applet - PyInjector - injects shellcode straight into memory through a byte compiled python executable. Does not require python to be installed on victim
* Added base64 encoded to the parameters passed in shellcodexec and pyInjector
* Added base64 decode routine in Java Applet using sun.misc.BASE64Decoder - native base64 decoding in Java is the suck
* Java Applet redirect has been fixed - was a bug in how dynamic config files were changed
* Fixed the UNC embed to work when the flag is set properly in the config file
* Fixed the Java Repeater which would not work even if toggled on within the config file
* Fixed an operand error when selecting high payloads, it would cause a non harmful error and an additional delay when selecting certain payloads in Java Applet
* Added anti-debugging protection to pyinjector
* Added anti-debugging protection to SET interactive shell
* Added anti-debugging protection to Shellcodeexec
* Added virtual entry points and virtualized PE files to pyinjector
* Added virtual entry points and virtualized PE files to SET interactive shell
* Added virtual entry points and virtualized PE files to Shellcodeexec
* Added better obfsucation per generation on SET interactive shell and pyinjector
* Redesigned Java Applet which adds heavily obfsucated methods for deploying
* Removed Java Applet source code from being public - since redesign of applet, there are techniques used to obfuscate each time that are dynamic, better shelf life for applet
* Added a new config option to allow you to select the payloads for the powershell injection attack. By specifying the config options allows you to customize what payload gets delivered via the powershell shellcode injection attack
* Added double base64 encoding to make it more fun and better obfuscation per generation
* Added update_config() each time SET is loaded, will ensure that all of the updates are always present and in place when launching the toolkit
* Rewrote large portions of the Java Applet to be dynamic in nature and place a number of non descriptive things into place
* Added better stability to the Java Applet attack, note that the delay between execution is a couple seconds based on the obfuscation techniques in place
* Completely obfsucated the MAC and Linux binaries and generate a random name each time for deployment
* Fixed a bug that would cause custom imported executables to not always import correctly
* Fixed a bug that would cause a number above 16 to throw an invalid options error
* Added better cleanup routines for when SET starts to remove old cached information and files
* Fixed a bug that caused issues when deploy binaries was turned to off, would cause iterative loop for powershell and crash IE
* Centralized more routines into set.options - this will be where all configuration options reside eventually
* Added better stability when the Java Applet Repeater is loaded, the page will load properly then execute the applet.
* The site cloner has been completely redesigned to use urllib2 instead of wget, long time coming
* The cloner file has been cleaned up from a code perspective and efficiency
* Added better request handling with the new urllib2 modules for the website cloning
* Added user agent string configuration within the SET config and the new urllib2 fetching method
* Added a pause when generating Teensy payloads
* Added the Offensive-Security "Peensy" multi-attack vector for the Teensy attacks
* Added the Microsoft Internet Explorer execCommand Use-After-Free Vulnerability from Metasploit into the Metasploit Browser Exploits Attack vectors
* Fixed a bug in cleanup_routine that would cause the metasploit browser exploits to not function properly
* Fixed a bug that caused the X10 sniffer and jammer to throw an exceptions if the folder already existed
~~~~~~~~~~~~~~~~
version 3.7.3
~~~~~~~~~~~~~~~~
* added better error handling on the java applet attack web server
~~~~~~~~~~~~~~~~
version 3.7.2
~~~~~~~~~~~~~~~~
* fixed an issue on some machines where the applet would not pop up right
~~~~~~~~~~~~~~~~
version 3.7.1
~~~~~~~~~~~~~~~~
* added the new java disableSecurity(); bypass native to the Java Applet - coded it funny, applet still pops up but if you hit cancel it executes no problem. Thought that would be more believable.
~~~~~~~~~~~~~~~~
version 3.7
~~~~~~~~~~~~~~~~
* added better xp_cmdshell restore options in the MSSQL attack vector for Fast-Track
* minor changes to the java applet around parameter names and signing
* added the ability to do native shellcode injection into the SET interactive shell
* added the ability to do native injection in x86 and x64 now
* reliability update to the shellcode injection attack
* added better handling around corrupt stack injection in the shellcode injection
* added AES256 support for the communication around the SET interactive shell and the new shellcode injection attack
* added the new zero day exploit from the Metasploit Framework - Java 7 Applet Remote Code Execution
* fixed a bug that caused the browser autopwn to not function properly when selected and would move to the java applet instead
* bug fixes for teensy powershell downloader (thanks John Strand)
* fixed a number of menu system bugs including moving back and forward
* fixed a multiattack issue when using java applet and metasploit client attacks
* added dates to all of the metasploit exploits to show how recent they are
~~~~~~~~~~~~~~~~
version 3.6
~~~~~~~~~~~~~~~~
* adds the new SCCM attack vector to the social-engineer toolkit - allows you to patch SCCM servers to deploy backdoors
* updated the web gui interface to add updates to exploits
* fixed a menu bug in the web interface that would repeater numbers
* added the MSCOMCTL ActiveX Buffer Overflow (ms12-027) exploit to the web interface
* added the shellcodeexec alphanumeric shellcode paylaod to the web interface
* added Java Applet Field Bytecode Verifier Cache Remote Code Execution to the web interface
* added MS12-037 Internet Explorer Same ID Property Deleted Object Handling Memory Corruption to the web interface
* added Microsoft XML Core Services MSXML Uninitialized Memory Corruption to the web interface
* added Adobe Flash Player Object Type Confusion to the web interface
* fixed a menu bug that would not allow you to return to the previous menu in the java applet
* fixed a bug that would cause the multiattack metasploit, java applet, and cred harvester to not work on the right ports and raise a exceptions
* added background listener to credential harvester and multiattack -- allows credential harvester to continue to run even if metapsloit has been exited
* fixed a bug that would still flag any website as cloned successfully. The new code fixes that by checking to ensure the site was properly cloned.
* fixed a cloning web bug that would error out then continue with payload selection
* added a cleanup routine to the web cloner for post completion on the cloner, this fixes a repetitive issue when launching multiple attacks in the menu system
~~~~~~~~~~~~~~~~
version 3.5.4
~~~~~~~~~~~~~~~~
* major bug fix for when webattak_email was specified to on, would cause the entire java applet attack to crash
~~~~~~~~~~~~~~~~
version 3.5.3
~~~~~~~~~~~~~~~~
* bug fix for multiattack to allow credential harvester and java applet to continue to run
~~~~~~~~~~~~~~~~
version 3.5.2
~~~~~~~~~~~~~~~~
* multiple bug fixes for the ettercap functionality within SET
~~~~~~~~~~~~~~~~
version 3.5.1
~~~~~~~~~~~~~~~~
* Fixed a bug in command center that would cause it to not load properly.
* Fixed a bug in the new Java Applet Field Bytecode that would cause it to not properly select the payload
* Added compatibility for IE10 on the Java Applet Attack Vector
* Turned AUTO_MIGRATE=OFF to AUTO_MIGRATE=ON by default, allows sticky processes to free up when exploitation occurs
* Added a new config option DEPLOY_BINARIES. When this is turned OFF, the Java Applet will only use the POWERSHELL_INJECTION technique and never deploy a binary. Note that you must know if the victim has POWERSHELL installed.
* Fixed a couple typos in the credential harvester
* Fixed a bug in the SET interactive shell that caused it to crash
* Updated and packed the SET interactive shell for AV evasion
~~~~~~~~~~~~~~~~
version 3.5
~~~~~~~~~~~~~~~~
* redesigned Java Applet attack in order to add better obfsucation
* SET Interactive Shell has been encrypted, thrown into a virtual machine, and anti-debugging technology put around it
* Shellcodeexec has been encrypted, thrown into a virtual machine, and anti-debugging technology put around it
* Updated all of the SET_Manual documentation to be current with 3.5, under readme
* AUTO_DETECT=ON has now been changed to AUTO_DETECT=OFF. To many questions from folks in NAT situations.
* Dynamic parameter allocation used for Java Applet now - Should allow better obfsucation per instance on applet
* Fixed a bug that caused shellcodeexec to not properly function under x86 vista (strange bug, but fixed)
* Added the Java Applet Field Bytecode Verifier Cache Remote Code Execution from Metasploit
* Added better obfuscation to a number of core SET modules for better evasive techniques against security mechanisms
~~~~~~~~~~~~~~~~
version 3.4.1
~~~~~~~~~~~~~~~~
* added a new prompt if apache is detected to be running, if your using the standard /etc/init.d/apache2 path, it will prompt you to turn off Apache as an option now instead of exiting SET
* fixed a formatting loop when using the web attack that would cause the user to have to control out
* minor bug fixes
~~~~~~~~~~~~~~~~
version 3.4
~~~~~~~~~~~~~~~~
* Implemented SET debugging (turned it all on). This should allow developers and users to troubleshoot while watching SET navigate it's 'roadmap'...without setting up a third party debugger.
* Debugging functions streamlined down into 1 in setcore.
* Debugging levels increased to 6.
* Began implementation of user input validation-validating web site, IP, ports, yes/no responses in ratte modules first. Fixes a bug where SET attempts to continue without a required parameter.
* Added the ability to select a list of IP addresses for SQL servers and import them into Fast-Track versus CIDR notations or IP addresses - can do all three now
* Streamlined the Fast-Track MSSQL bruting through multithreading - ability to attack multiple SQL servers faster
* better obfuscation on SET interactive shell
* better obfuscation on SET HTTP shell
* added the ability to the Java Applet to write out a logfile that can be used for the IP address and port - this will be used lateron for multiple other attacks
* fixed a bug with open relays and no username and password prompt, it would issue AUTH command which is not needed - thanks Justin Alcorn!
* added better obfuscation on the set interactive shell and now includes a read-in logfile so you don't need to pass parameters to it -- will be used later
* recompiled the SET HTTP shell with some new functionality and features
* Cleaned up Translation for RATTE-Server Interface
* Updated Main Menu
* Changed ownership of SET to TrustedSec, LLC - Don't worry everyone its still free and nothing has changed AT ALL!
* Added the MS12-037 Internet Explorer Same ID Property Deleted Object Handling Memory Corruption exploit from Metasploit
* Added the Microsoft XML Core Services MSXML Uninitialized Memory Corruption exploit from Metasploit
* Added the MYSQL Authentication Bypass Exploit into Fast-Track
* Added the F5 Root Authentication Bypass exploit into Fast-Track
* Added the Adobe Flash Player Object Type Confusion exploit from Metasploit
* Fixed a bug during payload creation that could cause a list index exception.
* Minor performance enhancements
~~~~~~~~~~~~~~~~
version 3.3.1
~~~~~~~~~~~~~~~~
* fixed a bug that would cause report generator to error out using the multiattack vector
* fixed a wording issue for credential harvester
* fixed a path generation issue with report generator when using different calls
* bug fix for harvester when importing new debug information had to change directory to base path for import
~~~~~~~~~~~~~~~~
version 3.3
~~~~~~~~~~~~~~~~
* added new menu powershell attack vectors -- will be used for powershell based attacks
* added new payload powerdump to the powershell attack vectors
* added new payload bind shell to the powershell attack vectors
* added new payload powershell shellcode injection to the powershell attack vectors
* new core routine added for powershell_convert(powershell_command) which will do all the proper unicode + base64 encoding needed for powershell -EncodedCommand bypass
* new core routine added powershell_generate_payload(payload,ipaddr,port,powershell_command). This will create the necessary alphanumeric shellcode needed through metasploit in order to successfully create the powershell injection attack
* added ms12-027 to the spear phishing attack vectors - MSCOMCTL ActiveX Buffer Overflow (from Metasploit)
* added new payload reverse shell to powershell attack vectors
* fixed a bug in metasploit browser exploits where the numbers were off and would not properly parse the exploit (thanks for the report Dale Pearson)
* added a pause when using the apache menu so it doesn't automatically exit
* added a pause when something is on port 80 for credential harvester to display the error message
* added a new phishing template provided by chap0, thanks for the contribution!
* fixed a wording issue within fasttrack exploit selection, it was asking for a nmap range, it should read which exploit do you want
* added the Solarwinds Storage Manager 5.1.0 Remote SYSTEM SQL Injection Exploit exploit by muts into Fast-Track
* added the RDP use after free DoS into SET in the Fast-Track custom exploits section
* added new subroutine for powershell conversion
* added automatic convert for powershell alphanumeric shellcode to automatically encode the commands
* added the menu system for the new powershell menu
* added ability to leverage msf payloads in the alphnaumeric shellcode
* added metasploit listener option for the powershell attack
* added a new native python socket listener for a standard reverse shell routine in setcore socket_listener(port)
* added powershell bind shell into the new powershell interpreter attack vector
* added new core routine for powershell alphanumeric injection and conversion with msfvenom
* added functionality through powershell.py to dynamically generate payloads and inject through powershell
* removed large portion of prep.py and centralized through setcore routines
* added powershell powerdump to the attack vectors for powershell attacks
* fixed a bug that would prompt twice for an IP address in the new powershell attack
~~~~~~~~~~~~~~~~
version 3.2.3
~~~~~~~~~~~~~~~~
* removed the license restrictions
~~~~~~~~~~~~~~~~
version 3.2.2
~~~~~~~~~~~~~~~~
* added license restrictions
~~~~~~~~~~~~~~~~
version 3.2.1
~~~~~~~~~~~~~~~~
* fixed a pesky bug where in the SET interactive shell it would not show UAC-SAFE or SYSTEM due to a python global bug issues - I've written a workaround so it properly displays
* fixed a bug with the new menu system in payloads, selection option 15 or 14 would bomb out
* fixed an annoying bug that when backing out or quiting in the SET interactive shell it would not properly exit and go into a loop
* added better stability in the event that a connection is terminated prematurely from the SET interactive shell
* fixed alignment on comment code in listener, it was all off whack
* removed un-needed keyboardinterrupts in the listener for the setshell
* fixed a bug that would sprout up every so often with bypassuac which would cause an exceptions and the shell to die
* added the Java Atomic, adobe flash mp4, and ms12-004 exploits to the web gui
* added the Adobe Reader u3D memory corruption vulnerability to the infectious media webgui
~~~~~~~~~~~~~~~~
version 3.2
~~~~~~~~~~~~~~~~
* added new payload to the HTTP attack vectors - the SET Reverse HTTP Shell which uses native AES encryption for tunneling commands back and forth
* added the new SET RevHTTP shell into the Java Applet attack vector
* added the Java AtomicReferenceArray Type Violation Vulnerability exploit to the Metasploit attack vectors
* added the Adobe Flash Player MP4 'cprt' Overflow exploit to the Metasploit attack vectors
* added the MS12-004 midiOutPlayNextPolyEvent Heap Overflow exploit to the Metasploit attack vectors
* added an exceptions in for the Java AtomicReferenceArray to select java meterpreter versus standard since its specific to exploit
* reintroduced the set-web shell into the main repositories, still may be buggy -- plan on rewriting soon
* added changes and obfuscation to the SET RevHTTP and changed the cipher key exchanges for the binary
* added a quit routine to the new SET RevHTTP shell -- quit and exit work
* recompiled the SET RevShell to be nonconsole so it will not spit any input out even if its discovered
* removed slim_set.py it was no longer being used and no longer needed
* fixed an error that would be thrown when finished with an attacker vector then go to launch another attack it would throw an attack_vector not found exceptions (thanks Vinny Troia for the report)
~~~~~~~~~~~~~~~~
version 3.1.4
~~~~~~~~~~~~~~~~
* fixed a bug with SSL and harvester erroring out on importing ssl, changed it to setssl versus import ssl (thanks Vlad)
* fixed a bug in harvester SSL that would terminate SET when the SSL certificate was moved (thanks Vlad)
* fixed a bug where an exceptions would trigger and error would not be defined in harvester (thanks Vlad)
~~~~~~~~~~~~~~~~
version 3.1.3
~~~~~~~~~~~~~~~~
* fixed a bug that caused APACHE_SERVER=ON to trigger in set_config
* added better handling around the config file to detect config options versus conflictions with wording inside text and check for comment code first
* fixed a major bug that would cause the java applet to not properly load a website
* added better routine in check_config for comment code
* added startswith to all checks on config file for better granularity on configuration options
* fixed a menu rendering issue and fixed the codename: was missing a single quote and addded Garland to the development team
* fixed a bug if you were importing a custom payload the parameter "freehugs" would be appended to the executable path so blah.exe freehugs would cause exceptions for backdoors that took command line arguments
~~~~~~~~~~~~~~~~
version 3.1.2
~~~~~~~~~~~~~~~~
* added a new feature to disable the automatic listener from starting on metasploit - its under config/set_config 'AUTOMATIC_LISTENER=ON' (thanks for the recommendation Viss)
* fixed a bug that might cause the config/set_config to not be found in instances where os.chdir was used and path would not be found
* removed some old wording if apache was turned on
* added a exceptions handler for cleanup_routine that would error out if it couldn't shutil.copyfile for original applet
* added the ability if metasploit was not detected to still allow payload selection through RATTE or SEToolkit
* fixed a bug that would cause an exceptions on AUTOMATIC_LISTENER not defined if control-c'd out
* added a new config option for METASPLOIT_MODE if its enabled it will give you metasploit options, if not it will disable metasploit functionality and perform with SE Toolkit and RATTE as an option
* added a new feature into SET called HARVESTER_REDIRECT=ON/OFF and HARVESTER_URL=http://blah - this will allow you to specify what website harvester redirects on when the user posts to the website. before you could only have it go back to the legitimate site... (thanks Dale Pearson for the suggestion)
* added better description around web ports under config/set_config to include if your using APACHE_SERVER=ON
~~~~~~~~~~~~~~~~
version 3.1.1
~~~~~~~~~~~~~~~~
* updated the path variables to be compliant with BT5 R2 and the new MSF path
* bug fix that would cause msf path to not be properly displayed
* fixed a bug that would cause an error out in multiattack (thanks Chris Barrow)
* added better discovery of metasploit paths if not found
~~~~~~~~~~~~~~~~
version 3.1
~~~~~~~~~~~~~~~~
* added better error handling within harvester.py - should fix a transmission error bug when users close the browser half way through
* licensing has been changed to reflect 2012 and the new hug licensing agreement :) will prompt now the next time you launch set
* fixed a bug if you were using self signed java applets, it would throw an error that signapplet was already used - added randomized string values to it
* did some code cleanup on harvester and removed old code
* changed self_sign.py to import from setcore libraries
* fixed a bug that when importing own custom executable into SET would throw an exception due to shutil.copyfile not properly defining file name
* added a break within the custom import exe to trigger a while 1 loop to not terminate web server thread - control-c exits when finished with java applet attack
* rehauled the set-web interface and is now back to being supported and included into the main libraries
* fixed a spacing issue when selecting the spear phishing menu between the last two exploits
* added Adobe U3 exploit to the phishing site for set-web
* added the Rhino Java Exploit to the webattack site for set-web
* rehauled most modules to change from src.core import setcore to from src.core.setcore import *
* fixed a bug that if you were using web templates and select SE Toolkit payload it would error out
* fixed a bug that caused the listener.py to not be found when using web templates
* added a new check routine for set.options which will be the central store for all set related options versus different files
* added the new check routine into spawn.py to check for custom executables, will start converting everything in next release
* fixed a bug that would call nix.bin to not be found and error out
~~~~~~~~~~~~~~~~
version 3.0
~~~~~~~~~~~~~~~~
* added the Adobe U3D memory corruption exploit from Metasploit to SET
* added new core library check_os for smart OS detection
* bug fix in Phishing using the smtp_client module (Thanks for the patch Stephen Haywood)
* rehauled set launcher to be windows compliant
* rehauled set-proxy to be windows compliant
* rehauled setup.py to be windows compliant
* rehauled setcore to be windows compliant
* added a new directory called thirdparty, this will dynamically import modules that are required versus having to install, if that fails you will have to manually download and install the depends
* removed the subprocess.Popen depends on src/core/set.py, this is no longer needed and covered to os.remove, os.makedirs, and shutil.copyfile instead
* Completely rehauled src/html/web_server.py to where it is no longer needed using pexpect. The goal is to move all depends to not require pexepct as it is not supported in Windows. All code now resides in src/html/spawn.py and is multi threading and background threaded
* spawn.py uses multi-threaded webserver and rehauled to be windows compliant. pexpect is no longer used for windows systems as it is not supported, had to move to os.system for now, importing the module with thread locks caused lockup issues
* rehauled listener.py to be compatible with windows
* fixed a bug that would cause pexpect to not be found if selecting SET interactive shell (no longer needed)
* rehauled src/webattack/web_clone/cloner.py to be windows compliant and now supports java applet attack rewrite for wgeting websites
* changed set executable to cleanup program_junk but skip .svn which would cause conflicts, this works on both windows and nix based systems
* fixed a bug on credential harvester if it wasn't installed it should except via ImportError versus IndexError. this was changed to ImportError and allow normal execution while disabling SSL support
* rehauled src/webattack/harvester/scraper.py to be windows compliant
* rehauled src/webattack/harvester/harvester.py to be windows compliant
* added the ability to keep execution flow of the backdoored executable (thanks pure_hate), this is now configurable through the config/set_config but disabled by default
* added a new option in config/set_config to allow customized user-agent strings when doing web_cloning..some websites only support certain browser versions, this will allow you to change to whatever browser ou want
* changed the user agent string from mozilla firefox 3.6 to be Windows 7 IE 8, more compatibility with websites: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)
* removed the ability to be able to use spear phishing or wireless attack vectors on Windows for now
* converted src/webattack/web_clone/cloner.py to be the standard import for setcore, it was from src.core import setcore as core, changed to from src.core.setcore import *
* bug fix when launching java applet attack and metasploit in 3.0 would cause the listener to not spawn properly
* bug fix when selecting the SET interactive shell it would not copy the proper executable to pack/obfuscate
* bug fix that would cause the last exploit in spear phishing to not show a number
* changed some output on wget to use -O instead of standard moves to filenames, much cleaner
* major bug fix on how the listener and SET interactive shell handled non-encrypted communications
* added proper encryption/decryption routines to interactive shell and set listener
* added the ability to leverage partial encryption/decryption of communications to interactive shell and listener
* fixed a bug that would cause the shell to not work properly due to an invalid content length when parsing through payload
* fixed a bug that would prompt for port on SET interactive shell even after it was specified
* rewrote fasttrack mssql attack vector to be windows compliant - had to switch off pexpect and move to os.system with unthreaded http server modules
* added verbose messaging to attack vectors that are not yet supported for SET
* rehauled multiattack to support windows-based attacks - it also now prompts if invalid payloads are selected
* fixed a bug that when selecting menu 99 within multiattack, would say invalid selection. it now properly exits
* increased the response time for using the SET interactive shell, it now loads much quicker
* added a new config option to either use a staged downloader or download the SET interactive shell directory, this new feature is best for A/V detection but might be a little slower on what the user experiences. All of my testing shows that it doesn't however I'm also not testing over the Internet. The main problem is the staged downloader does a download/exec which would get flagged by AV. The SET interactive shell on the other hand is a wrapped python interpreter so its much harder to detect and flag with signatures. This new config option can be turned on to support staged configs if you aren't worried about A/V.
* added new options within payloadprep.py (SET Interactive Shell prep) to detect the new config change options and flag the SE Interactive Shell as the main staged downloader
* rewrote the Java Applet attack including the jar file to incorporate the straight staged downloader
* added a new attack vector that I've been promising for several months called the QRCode Generator Attack Vector.. Create a QRCode with a URL then create a SET attack vector to assist with the attack
* added new set menus to setcore so when you launch set theres some new ascii art... yea i got a little bored
* fixed a bug that would cause the new stager option to not work within the Fast-Track MSSQL bruter menu
* added a check to see if metasploit path was found, if not it will limit payloads only to SE Toolkit ones
* added better handling around metasploit path detection and trigger error message when msf path is not set
* added checking in set.py to detect attack vectors that require metasploit
* added a new cleanup routine that circles through directories cleaning up remenants of things saved out during normal operation
* rewrote portions of teensy payloads to support windows
* fixed a bug that would cause the menu to not load properly randomly (randrang was from 1 to 8 versus 2 to 8)
* added permission change to executable on ratteserver so that it will always function normally if execute flag is removed
* fixed a path issue with RATTEServer that would cause it to not properly load and flag an issue
* converted RATTEServer to os.system versus pexpect child.spawn - easily more portable and less reliability on third party module
* added RATTEServer for Windows (Cygwin mod) to support Windows operating system
* added RATTEServer to payload selection list to now be supported via windows operating systems
* added RATTEServer to payloadprep and spawn.py to deploy RATTEServer based on operating system i.e. windows/posix
* added the ability to import custom binaries into windows versus linux only mode
* fixed a bug in RATTEServer that would flag an error when spawning RATTE on Windows
* added a chmod +x routine per each run of set instance if posix is detected.. will make it easier if certain permissions aren't set properly
* added the ability to natively copy ratteserver.binary and cygwin to program_junk to be run
* added payloadprep detailed error logging to the default log file being generated by SET
* rehauled java applet to add additional features and re-compiled and signed
* rewrote portions of shellcodeexec for better a/v avoidance
* fixed a bug that did not have __init__.py in the qrcode directory and threw an exceptions
* fixed a string literal bug in teensy that would cause an error (thanks for the report Rob)
* bug fix on time import for src/core/payloadprep.py (thanks Scott Behrens)
~~~~~~~~~~~~~~~~
version 2.5.3
~~~~~~~~~~~~~~~~
* fixed a bug that would not let you in the custom exploits menu within fasttrack
* fixed a bug that would cause _mssql not to be defined when attempting to custom connect to a SQL server
* fixed a bug that would cause mssql custom connect once finished to go straight into the exploit menu
* fixed a looping issue with the fasttrack menu
* bug fix when using the creeate payload and listener thanks to Scott Behrens for the submission
~~~~~~~~~~~~~~~~
version 2.5.2
~~~~~~~~~~~~~~~~
* fixed a bug when selecting RTF within SET fileformat attack, it would state no attachments found
* fixed a bug when selecting yahoo or live that would cause the body to bomb out with control-c
* added better support for delivery of payloads with spear phishing attack
* added a banner to support the SEToolkit and to vote at sectools.org
* reworded a few to remove references of BT4 and switched to BT5
* added the ability to change site.template during harvester in order to allow redirect to different URL mid attack
* added an additional check to see if in set_config msf-path ends with a trailing forward slash, if not it will append
* removed the static root path from /root/ to be os.enivorn HOME path instead based on user running SET
~~~~~~~~~~~~~~~~
version 2.5.1
~~~~~~~~~~~~~~~~
* fixed a bug on large websites that would clone and not finish properly and cause SET to error out that src/program_junk/web_clone/index.html was not found
* added better error granularity if index.html is not found, it will trigger a new warning message
* removed db_autopwn since it is no longer supported/removed in metasploit
* deleted the set-web interface, it is no longer maintained or kept up
* fixed a bug that would cause port1 not to be defined in the mssql bruter in fasttrack and not properly deliver a shell
* defaulted the target for the rhino exploit to be windows versus the generic java one it was set to
* added better error hanlding within SET, it should no longer crash SET
~~~~~~~~~~~~~~~~
version 2.5
~~~~~~~~~~~~~~~~
* rehaul of site cloner, it now injects into body properly and leverages unc, redirection, and others properly
* redid a few options on repeater.database, unc.database to make more streamline
* fixed bugs with java repeater
* added more granularity around how repeater operates and functions when on different webpages
* added ability to inject into tags first and if not found then it injects into