Arachni plugin #8618

brandonprry · 2017-06-26T23:53:37Z

This plugin adds support for driving an Arachni scan and saving the results in the Metasploit database. However, it seems that web vulns aren't displayed in the vulns table in msfconsole. This might be a bug, I'm not sure, but I vaguely remember having the same issue when developing the sqlmap plugin.

msf > load arachni
[*] Arachni plugin loaded.
[*] Successfully loaded plugin: Arachni
msf > arachni_connect
msf > arachni_scan http://demo.testfire.net/default.aspx "xss*"
msf > arachni_scanlog
[+] 1. Cross-Site Scripting (XSS)
[+] Scan running: true
msf > arachni_scanlog
[+] 1. Cross-Site Scripting (XSS)
[+] 2. Cross-Site Scripting (XSS) in HTML tag
[+] 3. Cross-Site Scripting (XSS)
[+] Scan running: false
msf > arachni_savelog
msf > vulns
msf > web_vulns
[-] Unknown command: web_vulns.
msf >

I am probably going to make arachni_scanlog print a Rex::Table, but I wanted to ask about web vulns being displayed in the vulns table.

brandonprry · 2017-06-26T23:54:32Z

Oh, The arachni classes in Rex::Proto were shamelessly stolen from the arachni-rpc-pure Github repo, but these are license with 2- or 3-clause BSD, which I think is compatible with Metasploit.

sempervictus

Awesome! Thank you.
Big fan of the proper separation of plugin CRUD and library components for interface. Would even suggest pushing a few more pieces to the client such as the dispatcher and instance init.

Going to try and put it through its paces tomorrow, run some functional tests and see how it works with scan grids.

Only real issue i see on first pass is the sockets use here, admittedly as i'm on a crusade to eliminate all ...Socket.new calls in the codebase (pivot all the things!).

Thanks again

sempervictus · 2017-06-27T07:54:13Z

lib/rex/proto/arachni/connection.rb

+                OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
+        end
+
+        @socket = OpenSSL::SSL::SSLSocket.new(


Would probably make sense to use Rex::Socket::TcpSsl for this to allow us to access Arachni installs on the other side of a compromised host (for instance if deploying the scanner as a form of payload for rapid internal web scans of the environment).
Forcing TLS validation may also be a problem in some cases, though optional validation is definitely a good thing (even a good default, just suggesting the option of NO_VERIFY).
Rex Socket SSL client certificate support may help a bit for this.

sempervictus · 2017-06-27T07:59:08Z

lib/rex/proto/arachni/connection.rb

+    end
+
+    def receive_object
+        while data = @socket.sysread( 99999 )


May want to comment this process for intent and functionality - what's being recv'd, unpacked, and unserialized.

sempervictus · 2017-06-27T07:59:09Z

lib/rex/proto/arachni/connection.rb

+        begin
+            Zlib::Inflate.inflate string
+        rescue Zlib::DataError
+            string


Any danger in potentially returning incompletely received binary data here?

Potentially, I suppose, but I'm not sure of a better way to handle the situation. This is functionally equivalent of checking the first few header bytes to determine if the string is actually zlib-compressed, and, if not, just return the data as is.

You can't know if the data is zlib compressed without testing it.

sempervictus · 2017-06-27T08:28:51Z

plugins/arachni.rb

+      }
+    end
+
+    def cmd_arachni_connect(*args)


If the localhost isnt the Arachni master, this approach blows up:

[-] Error while running command arachni_connect: Connection refused - connect(2) for "127.0.0.1" port 7331 Call stack: /opt/metasploit4/msf4/lib/rex/proto/arachni/connection.rb:51:in `initialize' /opt/metasploit4/msf4/lib/rex/proto/arachni/connection.rb:51:in `new' /opt/metasploit4/msf4/lib/rex/proto/arachni/connection.rb:51:in `initialize' /opt/metasploit4/msf4/lib/rex/proto/arachni/client.rb:62:in `new' /opt/metasploit4/msf4/lib/rex/proto/arachni/client.rb:62:in `with_connection' /opt/metasploit4/msf4/lib/rex/proto/arachni/client.rb:53:in `call' /opt/metasploit4/msf4/plugins/arachni.rb:28:in `cmd_arachni_connect'

sempervictus · 2017-06-27T08:29:02Z

plugins/arachni.rb

+      )
+
+      instance_info = @dispatcher.call('dispatcher.dispatch', Rex::Text.rand_text_alpha(8))
+      @instance = Rex::Proto::Arachni::Client.new(


See above regarding remote masters

brandonprry · 2017-06-27T13:11:09Z

This won't work well with scan grids. I don't provide much power in managing multiple instances. You can't kick off multiple scans and track them, only one at a time. I wanted to keep it simple and easy to use.

pbarry-r7 · 2017-06-30T16:49:43Z

Hey @bperry-r7, you might try loading the wmap plugin (load wmap) and see if the web vulns show up with its wmap_vulns -l command:

msf > load wmap

.-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] ===  et [  ] metasploit.com 2012
[*] Successfully loaded plugin: wmap
msf > wmap_vulns
[*] Usage: wmap_vulns [options]
	-h 		Display this help text
	-l 		Display web vulns table

msf > wmap_vulns -l
[*] + [10.0.0.1] (mysite.info): imported //xmlrpc.php
[*] 	The GHOST Vulnerability 
[*] 	POST <empty response>
[*] + [10.0.0.1] (mysite.info): imported /
[*] 	WordPress Cross-Site Scripting Vulnerability 
[*] 	GET <empty response>
[*] + [10.0.0.1] (mysite.info): imported /
[*] 	WordPress Multiple Cross-Site Scripting Vulnerabilities 
[*] 	GET <empty response>
.
.
.

brandonprry · 2017-07-01T20:10:17Z

You're right, that works to display the vulns in the database. Thanks! They should also appear in the community/pro interface regardless (as long as they are in the same workspace).

brandonprry · 2017-07-11T12:48:26Z

Unfortunately I've not had time to wrap this up. I will soon though.

acammack-r7 · 2018-12-14T23:55:29Z

Hey @brandonprry, in order to help us have a better handle on which PRs are currently in progress, I am closing this for now and adding the attic label. You can learn about our new PR label on our wiki. Feel free to reopen once work resumes, I love having integrations to other tools!

bcoles · 2020-03-30T11:55:32Z

Arachni was archived in January 2020 and is no longer supported.

brandonprry added 2 commits June 26, 2017 18:49

arachni plugin

b688c32

remove debugging puts

4b6997f

sempervictus reviewed Jun 27, 2017

View reviewed changes

busterb added the feature label Jul 7, 2017

bcoles added the blocked Blocked by one or more additional tasks label Nov 28, 2018

acammack-r7 added the attic Older submissions that we still want to work on again label Dec 5, 2018

acammack-r7 closed this Dec 14, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Arachni plugin #8618

Arachni plugin #8618

brandonprry commented Jun 26, 2017 •

edited

brandonprry commented Jun 26, 2017

sempervictus left a comment

sempervictus Jun 27, 2017

sempervictus Jun 27, 2017

sempervictus Jun 27, 2017

brandonprry Jun 27, 2017

brandonprry Jun 27, 2017

sempervictus Jun 27, 2017

sempervictus Jun 27, 2017

brandonprry commented Jun 27, 2017 •

edited

pbarry-r7 commented Jun 30, 2017

brandonprry commented Jul 1, 2017

brandonprry commented Jul 11, 2017

acammack-r7 commented Dec 14, 2018 •

edited

bcoles commented Mar 30, 2020

Arachni plugin #8618

Arachni plugin #8618

Conversation

brandonprry commented Jun 26, 2017 • edited

brandonprry commented Jun 26, 2017

sempervictus left a comment

Choose a reason for hiding this comment

sempervictus Jun 27, 2017

Choose a reason for hiding this comment

sempervictus Jun 27, 2017

Choose a reason for hiding this comment

sempervictus Jun 27, 2017

Choose a reason for hiding this comment

brandonprry Jun 27, 2017

Choose a reason for hiding this comment

brandonprry Jun 27, 2017

Choose a reason for hiding this comment

sempervictus Jun 27, 2017

Choose a reason for hiding this comment

sempervictus Jun 27, 2017

Choose a reason for hiding this comment

brandonprry commented Jun 27, 2017 • edited

pbarry-r7 commented Jun 30, 2017

brandonprry commented Jul 1, 2017

brandonprry commented Jul 11, 2017

acammack-r7 commented Dec 14, 2018 • edited

bcoles commented Mar 30, 2020

brandonprry commented Jun 26, 2017 •

edited

brandonprry commented Jun 27, 2017 •

edited

acammack-r7 commented Dec 14, 2018 •

edited