PR #133 cleaned - Autosploit Automation #134
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 4 commits
April 9, 2018 17:35
./dryrun_autosploit.sh will search censys/shodan/etc and do a dry-run against discovered hosts that are in the whitelist. VALIDATE THE DRYRUN REPORT BEFORE LAUNCHING THE ACTUAL EXPLOIT RUN ./run_autosploit.sh will run autosploit in exploit mode against previously discovered hosts in the whitelist.
Added a fuzzers-only json file. In the same idea, Trans2open exploits are taking about 2h+ per host to run. Maybe implement a "long run" feature in the next release?
COMES WITHOUT WARRANTY. Use as a starting point. Tweaks to make it usable for dev: - Setup a synced folder with your autosploit dev in the Vagrantfile Refer to vagrant doc. - Use vagrant rsync-auto Since vagrant file cannot really be shared as-is, some tweakings might be necessary. Try: -Modifying the Vagrantfile according to your ssh keys path -Installing the aws-cli pacakge -Configuring ~/.aws directory
Successful exploits will start meterpreter in background. Fixed counter for successful exploits/failed exploits bug, counting success/failure occurence, not line outputs. Success/failures now grepping escaped MSF output for success/failures. Grepping for keywords such as "Meterpreter", "Session" for success.
Ekultek
approved these changes
Apr 9, 2018
|
Love it |
|
Merging |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
#133 Rebased and cleaned.
PR Breakdown:
Bash script usage:
./dryrun_autosploit.sh whitelist.txt "search_query"
Will search censys/shodan/etc and do a dry-run against discovered hosts that are in the whitelist.
This will generate a report containing the dry-run results for every hosts in the whitelist.
This does NOT exploit anything.
./run_autosploit.sh
Will run autosploit in exploit mode against previously discovered hosts in the whitelist.
This will generate a report with MSF results for every hosts in the whitelist.
Important:
The code to compare each hosts against a whitelist hasn't been thoroughly tested. If you don't validate a dryrun report and run the "run_autosploit.sh" script, and you hit hosts that are outside your given scope, you have been warned. Run at your own risks.