CANVAS v6.51 released

by

In: CANVAS , Commercial , Exploitation , Penetration testing & Ethical Hacking

8 October 2009

Immunity’s CANVAS makes available hundreds of exploits, an automated exploitation system, and a comprehensive, reliable exploit development framework to penetration testers and security professionals worldwide.

New Modules

  • SMBv2 local execution (CVE-2009-3103 & MS KB975497)
  • SMBv2 remote execution (CVE-2009-3103 & MS KB975497)
  • Word Press Sniplets 1.1.2 & 1.2.2 remote file include (CVE-2008-1059)
  • Strawberry 1.1.1 local file include (CVE-2009-1774)
  • SiteX <= 0.7.4.418 local file include (NoCVE)
  • cpCommerce 1.2.x remote file include (CVE-2009-1936)
  • Qt quickteam 2 remote file inlcude (CVE-2009-1551)

Changes
New standalone .app available for OS X - this comes bundled with all the required dependencies (Python, GTK2, PyGTK etc etc). Just drag, drop and double click :) (Tested on Tiger (Intel & PPC), Leopard (Intel & PPC) and Snow Leopard (Intel))

New install script for Linux, also grabs dependencies for Fedora, Redhat, Debian and Ubuntu. This is BETA so please let us know how you get on with this.

New dependency checking with gui pop up message boxes (even if it is the GUI dependencies that are missing!) informing of missing dependencies along with links to the relevant webpages.

New splash screen - can be controlled through the variable ’splashscreen’ in canvas.conf.

CANVAS can now be downloaded packaged in .tar.gz, .zip and a passworded .zip (to help avoid filtering gateways corrupting files)

Bug Fixes
Updated multiple client side modules to be more compatible with the sploitd delivery method:

acrobat_flash, acrobat_js, acrobat_js4, flash_duke, ms06_057, ms07_051, ms08_033, FoxitLaunchit, foxit_printf, ms06_024, ms06_071, ms07_004, ms09_002, ms09_029, ooo_230, acrobat_js3, firefox_35, flash_wild, foxit_Action, ie_setexpression, ms06_014, ms06_055, ms09_032, real_import, utorrent & js_recon.

screengrab permissions check error when saving captures to a directory with incorrect permissions getpriv & processinject incorrect return code/unpacking fixes qgimport multiple fixes to deal with a wider range of qualys imports MS08_068 message format error.

Post scriptum

Compliance Mandates


Related Articles

CANVAS
Commercial
Exploitation
Penetration testing & Ethical Hacking