Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revive: Explicitly target analyze results and determine payload compatibility #15263

Merged
merged 3 commits into from Jun 3, 2021

Conversation

adfoster-r7
Copy link
Contributor

@adfoster-r7 adfoster-r7 commented May 26, 2021

Reviving the original work of @acammack-r7, but with updating the tests to pass - #15197

Verification

I verified that the original analyze command's verification steps still work with the import script here:
#11191

Working:

msf6 auxiliary(scanner/http/title) > db_import ~/Downloads/m3_report.xml
[... omitted ...]
msf6 auxiliary(scanner/http/title) > analyze
[*] Analysis for 192.168.18.118 ->
[*]   exploit/windows/smb/ms17_010_eternalblue - ready for testing
[*]   exploit/windows/smb/ms17_010_eternalblue_win8 - ready for testing
[*]   exploit/windows/smb/ms17_010_psexec - credentials are required
[*]   exploit/windows/smb/smb_doublepulsar_rce - ready for testing
[*] Analysis for 192.168.222.151 ->
[*]   exploit/windows/smb/ms17_010_eternalblue - ready for testing
[*]   exploit/windows/smb/ms17_010_eternalblue_win8 - ready for testing
[*]   exploit/windows/smb/ms17_010_psexec - credentials are required
[*]   exploit/windows/smb/smb_doublepulsar_rce - ready for testing

And using the new -p option with a valid match:

msf6 exploit(windows/smb/ms17_010_eternalblue) > analyze -p windows/x64/meterpreter/reverse_tcp
[*] Analysis for 192.168.18.118 ->
[*]   exploit/windows/smb/ms17_010_eternalblue - ready for testing
[*]   exploit/windows/smb/ms17_010_eternalblue_win8 - ready for testing
[*]   exploit/windows/smb/ms17_010_psexec - credentials are required
[*]   exploit/windows/smb/smb_doublepulsar_rce - ready for testing
[*] Analysis for 192.168.222.151 ->
[*]   exploit/windows/smb/ms17_010_eternalblue - ready for testing
[*]   exploit/windows/smb/ms17_010_eternalblue_win8 - ready for testing
[*]   exploit/windows/smb/ms17_010_psexec - credentials are required
[*]   exploit/windows/smb/smb_doublepulsar_rce - ready for testing

Using the new -p option with an invalid match:

msf6 auxiliary(scanner/http/title) > analyze -p payload/linux/x86/shell_reverse_tcp_ipv6
[*] Analysis for 192.168.18.118 ->
[*]   exploit/windows/smb/ms17_010_eternalblue - none of the requested payloads match
[*]   exploit/windows/smb/ms17_010_eternalblue_win8 - none of the requested payloads match
[*]   exploit/windows/smb/ms17_010_psexec - credentials are required, none of the requested payloads match
[*]   exploit/windows/smb/smb_doublepulsar_rce - none of the requested payloads match
[*] Analysis for 192.168.222.151 ->
[*]   exploit/windows/smb/ms17_010_eternalblue - none of the requested payloads match
[*]   exploit/windows/smb/ms17_010_eternalblue_win8 - none of the requested payloads match
[*]   exploit/windows/smb/ms17_010_psexec - credentials are required, none of the requested payloads match
[*]   exploit/windows/smb/smb_doublepulsar_rce - none of the requested payloads match

There was additional discussion on how to test this within the original PR:

To verify this, we will likely need to use nmap imports/db_nmap should populate at least some of the necessary information. Also needs unit testing based on nmap information.
#15197 (comment)

But I have only verified the steps that I listed previously

acammack-r7 and others added 3 commits May 14, 2021 08:45
Doesn't really do anything that wasn't done already, but will provide a
good entry point for better and more flexible targeting use, e.g. by
breaking down the OS name with Recog when needed.
@adfoster-r7 adfoster-r7 changed the title Targeted analyze revival Revive: Explicitly target analyze results and determine payload compatibility May 26, 2021
@agalway-r7
Copy link
Contributor

agalway-r7 commented Jun 3, 2021

Have tested the -p flag works as expected with the m3_report.xml and the output of db_nmap -O -sV -Pn --script vuln, both of which result in expected behaviour

@agalway-r7 agalway-r7 merged commit 87d69c7 into rapid7:master Jun 3, 2021
@agalway-r7
Copy link
Contributor

agalway-r7 commented Jun 3, 2021

Release Notes

Added a -p flag to the analyze command, allowing users to specify a payload that should be considered for use with any suggested exploit modules. Output will inform the user if the specified payload can be used with suggested payloads.

@agalway-r7 agalway-r7 added the rn-enhancement release notes enhancement label Jun 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
rn-enhancement release notes enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants