269 lines
6.8 KiB
Ruby
Executable File
269 lines
6.8 KiB
Ruby
Executable File
#!/usr/bin/env ruby
|
|
|
|
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
#
|
|
# This script lists each module with its references
|
|
#
|
|
|
|
msfbase = __FILE__
|
|
while File.symlink?(msfbase)
|
|
msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase))
|
|
end
|
|
|
|
$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib')))
|
|
require 'msfenv'
|
|
|
|
$:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB']
|
|
|
|
require 'rex'
|
|
require 'msf/ui'
|
|
require 'msf/base'
|
|
require 'uri'
|
|
|
|
|
|
# See lib/msf/core/module/reference.rb
|
|
# We gsub '#{in_ctx_val}' with the actual value
|
|
def types
|
|
{
|
|
'ALL' => '',
|
|
'CVE' => 'http://cvedetails.com/cve/#{in_ctx_val}/',
|
|
'CWE' => 'http://cwe.mitre.org/data/definitions/#{in_ctx_val}.html',
|
|
'BID' => 'http://www.securityfocus.com/bid/#{in_ctx_val}',
|
|
'MSB' => 'http://technet.microsoft.com/en-us/security/bulletin/#{in_ctx_val}',
|
|
'EDB' => 'http://www.exploit-db.com/exploits/#{in_ctx_val}',
|
|
'US-CERT-VU' => 'http://www.kb.cert.org/vuls/id/#{in_ctx_val}',
|
|
'ZDI' => 'http://www.zerodayinitiative.com/advisories/ZDI-#{in_ctx_val}',
|
|
'WPVDB' => 'https://wpvulndb.com/vulnerabilities/#{in_ctx_val}',
|
|
'PACKETSTORM' => 'https://packetstormsecurity.com/files/#{in_ctx_val}',
|
|
'URL' => '#{in_ctx_val}'
|
|
}
|
|
end
|
|
|
|
STATUS_ALIVE = 'Alive'
|
|
STATUS_DOWN = 'Down'
|
|
STATUS_UNSUPPORTED = 'Unsupported'
|
|
|
|
sort = 0
|
|
filter = 'All'
|
|
filters = ['all','exploit','payload','post','nop','encoder','auxiliary']
|
|
type ='ALL'
|
|
match = nil
|
|
check = false
|
|
save = nil
|
|
http_timeout = 20
|
|
$verbose = false
|
|
|
|
opts = Rex::Parser::Arguments.new(
|
|
"-h" => [ false, "Help menu." ],
|
|
"-c" => [ false, "Check reference status"],
|
|
"-s" => [ false, "Sort by Reference instead of Module Type."],
|
|
"-r" => [ false, "Reverse Sort"],
|
|
"-f" => [ true, "Filter based on Module Type [All,Exploit,Payload,Post,NOP,Encoder,Auxiliary] (Default = ALL)."],
|
|
"-t" => [ true, "Type of Reference to sort by #{types.keys}"],
|
|
"-x" => [ true, "String or RegEx to try and match against the Reference Field"],
|
|
"-o" => [ true, "Save the results to a file"],
|
|
"-i" => [ true, "Set an HTTP timeout"],
|
|
"-v" => [ false, "Verbose"]
|
|
)
|
|
|
|
flags = []
|
|
|
|
opts.parse(ARGV) { |opt, idx, val|
|
|
case opt
|
|
when "-h"
|
|
puts "\nMetasploit Script for Displaying Module Reference information."
|
|
puts "=========================================================="
|
|
puts opts.usage
|
|
exit
|
|
when "-c"
|
|
flags << "URI Check: Yes"
|
|
check = true
|
|
when "-s"
|
|
flags << "Order: Sorting by License"
|
|
sort = 1
|
|
when "-r"
|
|
flags << "Order: Reverse Sorting"
|
|
sort = 2
|
|
when "-f"
|
|
unless filters.include?(val.downcase)
|
|
puts "Invalid Filter Supplied: #{val}"
|
|
puts "Please use one of these: #{filters.map{|f|f.capitalize}.join(", ")}"
|
|
exit
|
|
end
|
|
flags << "Module Filter: #{val}"
|
|
filter = val
|
|
when "-t"
|
|
val = (val || '').upcase
|
|
unless types.has_key?(val)
|
|
puts "Invalid Type Supplied: #{val}"
|
|
puts "Please use one of these: #{types.keys.inspect}"
|
|
exit
|
|
end
|
|
type = val
|
|
when "-i"
|
|
http_timeout = /^\d+/ === val ? val.to_i : 20
|
|
when "-v"
|
|
$verbose = true
|
|
when "-x"
|
|
flags << "Regex: #{val}"
|
|
match = Regexp.new(val)
|
|
when "-o"
|
|
flags << "Output to file: Yes"
|
|
save = val
|
|
end
|
|
}
|
|
|
|
flags << "Type: #{type}"
|
|
|
|
puts flags * " | "
|
|
|
|
def get_ipv4_addr(hostname)
|
|
Rex::Socket::getaddresses(hostname, false)[0]
|
|
end
|
|
|
|
def vprint_debug(msg='')
|
|
print_debug(msg) if $verbose
|
|
end
|
|
|
|
def print_debug(msg='')
|
|
$stderr.puts "[*] #{msg}"
|
|
end
|
|
|
|
def is_url_alive?(uri, http_timeout)
|
|
print_debug("Checking: #{uri}")
|
|
|
|
begin
|
|
uri = URI(uri)
|
|
rhost = get_ipv4_addr(uri.host)
|
|
rescue SocketError, URI::InvalidURIError => e
|
|
vprint_debug("#{e.message} in #is_url_alive?")
|
|
return false
|
|
end
|
|
|
|
rport = uri.port || 80
|
|
path = uri.path.blank? ? '/' : uri.path
|
|
vhost = rport == 80 ? uri.host : "#{uri.host}:#{rport}"
|
|
if uri.scheme == 'https'
|
|
cli = ::Rex::Proto::Http::Client.new(rhost, 443, {}, true, 'TLS1')
|
|
else
|
|
cli = ::Rex::Proto::Http::Client.new(rhost, rport)
|
|
end
|
|
|
|
begin
|
|
cli.connect(http_timeout)
|
|
req = cli.request_raw('uri'=>path, 'vhost'=>vhost)
|
|
res = cli.send_recv(req, http_timeout)
|
|
rescue Errno::ECONNRESET, Rex::ConnectionError, Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::UnsupportedProtocol, ::Timeout::Error, Errno::ETIMEDOUT => e
|
|
vprint_debug("#{e.message} for #{uri}")
|
|
return false
|
|
ensure
|
|
cli.close
|
|
end
|
|
|
|
if res.nil? || res.code == 404 || res.body =~ /<title>.*not found<\/title>/i
|
|
vprint_debug("URI returned a not-found response: #{uri}")
|
|
return false
|
|
end
|
|
|
|
vprint_debug("Good: #{uri}")
|
|
|
|
true
|
|
end
|
|
|
|
def save_results(path, results)
|
|
begin
|
|
File.open(path, 'wb') do |f|
|
|
f.write(results)
|
|
end
|
|
puts "Results saved to: #{path}"
|
|
rescue Exception => e
|
|
puts "Failed to save the file: #{e.message}"
|
|
end
|
|
end
|
|
|
|
# Always disable the database (we never need it just to list module
|
|
# information).
|
|
framework_opts = { 'DisableDatabase' => true }
|
|
|
|
# If the user only wants a particular module type, no need to load the others
|
|
if filter.downcase != 'all'
|
|
framework_opts[:module_types] = [ filter.downcase ]
|
|
end
|
|
|
|
# Initialize the simplified framework instance.
|
|
$framework = Msf::Simple::Framework.create(framework_opts)
|
|
|
|
if check
|
|
columns = [ 'Module', 'Status', 'Reference' ]
|
|
else
|
|
columns = [ 'Module', 'Reference' ]
|
|
end
|
|
|
|
tbl = Rex::Text::Table.new(
|
|
'Header' => 'Module References',
|
|
'Indent' => 2,
|
|
'Columns' => columns
|
|
)
|
|
|
|
bad_refs_count = 0
|
|
|
|
$framework.modules.each { |name, mod|
|
|
if mod.nil?
|
|
elog("module_reference.rb is unable to load #{name}")
|
|
next
|
|
end
|
|
|
|
next if match and not name =~ match
|
|
|
|
x = mod.new
|
|
x.references.each do |r|
|
|
ctx_id = r.ctx_id.upcase
|
|
if type == 'ALL' || type == ctx_id
|
|
|
|
if check
|
|
if types.has_key?(ctx_id)
|
|
uri = types[r.ctx_id.upcase].gsub(/\#{in_ctx_val}/, r.ctx_val)
|
|
if is_url_alive?(uri, http_timeout)
|
|
status = STATUS_ALIVE
|
|
else
|
|
bad_refs_count += 1
|
|
status = STATUS_DOWN
|
|
end
|
|
else
|
|
# The reference ID isn't supported so we don't know how to check this
|
|
bad_refs_count += 1
|
|
status = STATUS_UNSUPPORTED
|
|
end
|
|
end
|
|
|
|
ref = "#{r.ctx_id}-#{r.ctx_val}"
|
|
new_column = []
|
|
new_column << x.fullname
|
|
new_column << status if check
|
|
new_column << ref
|
|
tbl << new_column
|
|
end
|
|
end
|
|
}
|
|
|
|
if sort == 1
|
|
tbl.sort_rows(1)
|
|
end
|
|
|
|
|
|
if sort == 2
|
|
tbl.sort_rows(1)
|
|
tbl.rows.reverse
|
|
end
|
|
|
|
puts
|
|
puts tbl.to_s
|
|
puts
|
|
|
|
puts "Number of bad references found: #{bad_refs_count}" if check
|
|
save_results(save, tbl.to_s) if save
|