1684 lines
52 KiB
Ruby
1684 lines
52 KiB
Ruby
# $Id$
|
|
# $Revision$
|
|
|
|
require 'nessus/nessus-xmlrpc'
|
|
require 'rex/parser/nessus_xml'
|
|
|
|
module Msf
|
|
class Plugin::Nessus < Msf::Plugin
|
|
|
|
#creates the index of exploit details to make searching for exploits much faster.
|
|
def create_xindex
|
|
start = Time.now
|
|
print_status("Creating Exploit Search Index - (#{@xindex}) - this wont take long.")
|
|
count = 0
|
|
# use Msf::Config.get_config_root as the location.
|
|
File.open("#{@xindex}", "w+") do |f|
|
|
#need to add version line.
|
|
f.puts(Msf::Framework::RepoRevision)
|
|
framework.exploits.sort.each { |refname, mod|
|
|
stuff = ""
|
|
o = nil
|
|
begin
|
|
o = mod.new
|
|
rescue ::Exception
|
|
end
|
|
stuff << "#{refname}|#{o.name}|#{o.platform_to_s}|#{o.arch_to_s}"
|
|
next if not o
|
|
o.references.map do |x|
|
|
if !(x.ctx_id == "URL")
|
|
if (x.ctx_id == "MSB")
|
|
stuff << "|#{x.ctx_val}"
|
|
else
|
|
stuff << "|#{x.ctx_id}-#{x.ctx_val}"
|
|
end
|
|
end
|
|
end
|
|
stuff << "\n"
|
|
f.puts(stuff)
|
|
}
|
|
end
|
|
total = Time.now - start
|
|
print_status("It has taken : #{total} seconds to build the exploits search index")
|
|
end
|
|
|
|
def nessus_index
|
|
if File.exist?("#{@xindex}")
|
|
#check if it's version line matches current version.
|
|
File.open("#{@xindex}") {|f|
|
|
line = f.readline
|
|
line.chomp!
|
|
if line.to_i == Msf::Framework::RepoRevision
|
|
print_good("Exploit Index - (#{@xindex}) - is valid.")
|
|
else
|
|
create_xindex
|
|
end
|
|
}
|
|
else
|
|
create_xindex
|
|
end
|
|
end
|
|
|
|
class ConsoleCommandDispatcher
|
|
include Msf::Ui::Console::CommandDispatcher
|
|
|
|
def name
|
|
"Nessus"
|
|
end
|
|
|
|
def commands
|
|
{
|
|
"nessus_connect" => "Connect to a nessus server: nconnect username:password@hostname:port <ssl ok>.",
|
|
"nessus_admin" => "Checks if user is an admin.",
|
|
"nessus_help" => "Get help on all commands.",
|
|
"nessus_logout" => "Terminate the session.",
|
|
"nessus_server_status" => "Check the status of your Nessus Server.",
|
|
"nessus_server_feed" => "Nessus Feed Type.",
|
|
"nessus_server_prefs" => "Display Server Prefs.",
|
|
"nessus_report_list" => "List all Nessus reports.",
|
|
"nessus_report_get" => "Import a report from the nessus server in Nessus v2 format.",
|
|
"nessus_report_del" => "Delete a report.",
|
|
"nessus_report_vulns" => "Get list of vulns from a report.",
|
|
"nessus_report_hosts" => "Get list of hosts from a report.",
|
|
"nessus_report_host_ports" => "Get list of open ports from a host from a report.",
|
|
"nessus_report_host_detail" => "Detail from a report item on a host.",
|
|
"nessus_scan_status" => "List all currently running Nessus scans.",
|
|
"nessus_scan_new" => "Create new Nessus Scan.",
|
|
"nessus_scan_pause" => "Pause a Nessus Scan.",
|
|
"nessus_scan_pause_all" => "Pause all Nessus Scans.",
|
|
"nessus_scan_stop" => "Stop a Nessus Scan.",
|
|
"nessus_scan_stop_all" => "Stop all Nessus Scans.",
|
|
"nessus_scan_resume" => "Resume a Nessus Scan.",
|
|
"nessus_scan_resume_all" => "Resume all Nessus Scans.",
|
|
"nessus_user_list" => "Show Nessus Users.",
|
|
"nessus_user_add" => "Add a new Nessus User.",
|
|
"nessus_user_del" => "Delete a Nessus User.",
|
|
"nessus_user_passwd" => "Change Nessus Users Password.",
|
|
"nessus_plugin_family" => "List plugins in a family.",
|
|
"nessus_plugin_details" => "List details of a particular plugin.",
|
|
"nessus_plugin_list" => "Displays each plugin family and the number of plugins.",
|
|
"nessus_plugin_prefs" => "Display Plugin Prefs.",
|
|
"nessus_policy_list" => "List all polciies.",
|
|
"nessus_policy_del" => "Delete a policy.",
|
|
"nessus_index" => "Manually generates a search index for exploits.",
|
|
"nessus_template_list" => "List all the templates on the server.",
|
|
"nessus_db_scan" => "Create a scan of all ips in db_hosts.",
|
|
"nessus_save" => "Save username/passowrd/server/port details."
|
|
}
|
|
end
|
|
|
|
def cmd_nessus_index
|
|
Msf::Plugin::Nessus.nessus_index
|
|
end
|
|
|
|
def cmd_nessus_save(*args)
|
|
#if we are logged in, save session details to nessus.yaml
|
|
@nessus_yaml = "#{Msf::Config.get_config_root}/nessus.yaml"
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_save")
|
|
return
|
|
end
|
|
|
|
if args[0]
|
|
print_status("Usage: ")
|
|
print_status(" nessus_save")
|
|
return
|
|
end
|
|
|
|
group = "default"
|
|
|
|
if ((@user and @user.length > 0) and (@host and @host.length > 0) and (@port and @port.length > 0 and @port.to_i > 0) and (@pass and @pass.length > 0))
|
|
config = Hash.new
|
|
config = {"#{group}" => {'username' => @user, 'password' => @pass, 'server' => @host, 'port' => @port}}
|
|
File.open("#{@nessus_yaml}", "w+") do |f|
|
|
f.puts YAML.dump(config)
|
|
end
|
|
print_good("#{@nessus_yaml} created.")
|
|
|
|
else
|
|
print_error("Missing username/password/server/port - relogin and then try again.")
|
|
return
|
|
end
|
|
end
|
|
|
|
def cmd_nessus_db_scan(*args)
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_db_scan <policy id> <scan name>")
|
|
print_status(" Example:> nessus_db_scan 1 \"My Scan\"")
|
|
print_status()
|
|
print_status("Creates a scan based on all the hosts listed in db_hosts.")
|
|
print_status("use nessus_policy_list to list all available policies")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 2
|
|
pid = args[0].to_i
|
|
name = args[1]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_db_scan <policy id> <scan name>")
|
|
print_status(" use nessus_policy_list to list all available policies")
|
|
return
|
|
end
|
|
|
|
if check_policy(pid)
|
|
print_error("That policy does not exist.")
|
|
return
|
|
end
|
|
|
|
tgts = ""
|
|
framework.db.hosts(framework.db.workspace).each do |host|
|
|
tgts << host.address
|
|
tgts << ","
|
|
end
|
|
|
|
tgts.chop!
|
|
|
|
print_status("Creating scan from policy number #{pid}, called \"#{name}\" and scanning all hosts in workspace")
|
|
|
|
scan = @n.scan_new(pid, name, tgts)
|
|
|
|
if scan
|
|
print_status("Scan started. uid is #{scan}")
|
|
end
|
|
|
|
end
|
|
|
|
def cmd_nessus_logout
|
|
@token = nil
|
|
print_status("Logged out")
|
|
system("rm #{@nessus_yaml}")
|
|
print_good("#{@nessus_yaml} removed.")
|
|
return
|
|
end
|
|
|
|
def cmd_nessus_help(*args)
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
"Command",
|
|
"Help Text"
|
|
],
|
|
'SortIndex' => -1
|
|
)
|
|
tbl << [ "Generic Commands", "" ]
|
|
tbl << [ "-----------------", "-----------------"]
|
|
tbl << [ "nessus_connect", "Connect to a nessus server" ]
|
|
tbl << [ "nessus_save", "Save nessus login info between sessions" ]
|
|
tbl << [ "nessus_logout", "Logout from the nessus server" ]
|
|
tbl << [ "nessus_help", "Listing of available nessus commands" ]
|
|
tbl << [ "nessus_server_status", "Check the status of your Nessus Server" ]
|
|
tbl << [ "nessus_admin", "Checks if user is an admin" ]
|
|
tbl << [ "nessus_server_feed", "Nessus Feed Type" ]
|
|
tbl << [ "nessus_find_targets", "Try to find vulnerable targets from a report" ]
|
|
tbl << [ "nessus_server_prefs", "Display Server Prefs" ]
|
|
tbl << [ "", ""]
|
|
tbl << [ "Reports Commands", "" ]
|
|
tbl << [ "-----------------", "-----------------"]
|
|
tbl << [ "nessus_report_list", "List all Nessus reports" ]
|
|
tbl << [ "nessus_report_get", "Import a report from the nessus server in Nessus v2 format" ]
|
|
tbl << [ "nessus_report_vulns", "Get list of vulns from a report" ]
|
|
tbl << [ "nessus_report_hosts", "Get list of hosts from a report" ]
|
|
tbl << [ "nessus_report_host_ports", "Get list of open ports from a host from a report" ]
|
|
tbl << [ "nessus_report_host_detail", "Detail from a report item on a host" ]
|
|
tbl << [ "", ""]
|
|
tbl << [ "Scan Commands", "" ]
|
|
tbl << [ "-----------------", "-----------------"]
|
|
tbl << [ "nessus_scan_new", "Create new Nessus Scan" ]
|
|
tbl << [ "nessus_scan_status", "List all currently running Nessus scans" ]
|
|
tbl << [ "nessus_scan_pause", "Pause a Nessus Scan" ]
|
|
tbl << [ "nessus_scan_pause_all", "Pause all Nessus Scans" ]
|
|
tbl << [ "nessus_scan_stop", "Stop a Nessus Scan" ]
|
|
tbl << [ "nessus_scan_stop_all", "Stop all Nessus Scans" ]
|
|
tbl << [ "nessus_scan_resume", "Resume a Nessus Scan" ]
|
|
tbl << [ "nessus_scan_resume_all", "Resume all Nessus Scans" ]
|
|
tbl << [ "", ""]
|
|
tbl << [ "Plugin Commands", "" ]
|
|
tbl << [ "-----------------", "-----------------"]
|
|
tbl << [ "nessus_plugin_list", "Displays each plugin family and the number of plugins" ]
|
|
tbl << [ "nessus_plugin_family", "List plugins in a family" ]
|
|
tbl << [ "nessus_plugin_details", "List details of a particular plugin" ]
|
|
tbl << [ "", ""]
|
|
tbl << [ "User Commands", "" ]
|
|
tbl << [ "-----------------", "-----------------"]
|
|
tbl << [ "nessus_user_list", "Show Nessus Users" ]
|
|
tbl << [ "nessus_user_add", "Add a new Nessus User" ]
|
|
tbl << [ "nessus_user_del", "Delete a Nessus User" ]
|
|
tbl << [ "nessus_user_passwd", "Change Nessus Users Password" ]
|
|
tbl << [ "", ""]
|
|
tbl << [ "Policy Commands", "" ]
|
|
tbl << [ "-----------------", "-----------------"]
|
|
tbl << [ "nessus_policy_list", "List all polciies" ]
|
|
tbl << [ "nessus_policy_del", "Delete a policy" ]
|
|
print_status ""
|
|
print_line tbl.to_s
|
|
print_status ""
|
|
end
|
|
|
|
def cmd_nessus_server_feed(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_server_feed")
|
|
print_status(" Example:> nessus_server_feed")
|
|
print_status()
|
|
print_status("Returns information about the feed type and server version.")
|
|
return
|
|
end
|
|
|
|
if nessus_verify_token
|
|
@feed, @version, @web_version = @n.feed
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Feed',
|
|
'Nessus Version',
|
|
'Nessus Web Version'
|
|
])
|
|
tbl << [@feed, @version, @web_version]
|
|
print_good("Nessus Status")
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
end
|
|
end
|
|
|
|
def nessus_verify_token
|
|
if @token.nil? or @token == ''
|
|
ncusage
|
|
return false
|
|
end
|
|
true
|
|
end
|
|
|
|
def nessus_verify_db
|
|
|
|
if ! (framework.db and framework.db.active)
|
|
print_error("No database has been configured, please use db_create/db_connect first")
|
|
return false
|
|
end
|
|
true
|
|
end
|
|
|
|
def ncusage
|
|
print_status("%redYou must do this before any other commands.%clr")
|
|
print_status("Usage: ")
|
|
print_status(" nessus_connect username:password@hostname:port <ssl ok>")
|
|
print_status(" Example:> nessus_connect msf:msf@192.168.1.10:8834 ok")
|
|
print_status(" OR")
|
|
print_status(" nessus_connect username@hostname:port <ssl ok>")
|
|
print_status(" Example:> nessus_connect msf@192.168.1.10:8834 ok")
|
|
print_status(" OR")
|
|
print_status(" nessus_connect hostname:port <ssl ok>")
|
|
print_status(" Example:> nessus_connect 192.168.1.10:8834 ok")
|
|
print_status(" OR")
|
|
print_status(" nessus_connect")
|
|
print_status(" Example:> nessus_connect")
|
|
print_status("This only works after you have saved creds with nessus_save")
|
|
return
|
|
end
|
|
|
|
def cmd_nessus_connect(*args)
|
|
# Check if config file exists and load it
|
|
@nessus_yaml = "#{Msf::Config.get_config_root}/nessus.yaml"
|
|
if ! args[0]
|
|
if File.exist?("#{@nessus_yaml}")
|
|
lconfig = YAML.load_file("#{@nessus_yaml}")
|
|
@user = lconfig['default']['username']
|
|
@pass = lconfig['default']['password']
|
|
@host = lconfig['default']['server']
|
|
@port = lconfig['default']['port']
|
|
nessus_login
|
|
return
|
|
else
|
|
ncusage
|
|
return
|
|
end
|
|
end
|
|
|
|
if args[0] == "-h"
|
|
print_status("%redYou must do this before any other commands.%clr")
|
|
print_status("Usage: ")
|
|
print_status(" nessus_connect username:password@hostname:port <ssl ok>")
|
|
print_status(" Example:> nessus_connect msf:msf@192.168.1.10:8834 ok")
|
|
print_status(" OR")
|
|
print_status(" nessus_connect username@hostname:port <ssl ok>")
|
|
print_status(" Example:> nessus_connect msf@192.168.1.10:8834 ok")
|
|
print_status(" OR")
|
|
print_status(" nessus_connect hostname:port <ssl ok>")
|
|
print_status(" Example:> nessus_connect 192.168.1.10:8834 ok")
|
|
print_status(" OR")
|
|
print_status(" nessus_connect")
|
|
print_status(" Example:> nessus_connect")
|
|
print_status("This only works after you have saved creds with nessus_save")
|
|
print_status()
|
|
print_status("%bldusername%clr and %bldpassword%clr are the ones you use to login to the nessus web front end")
|
|
print_status("%bldhostname%clr can be an ip address or a dns name of the web front end.")
|
|
print_status("%bldport%clr is the standard that the nessus web front end runs on : 8834. This is NOT 1241.")
|
|
print_status("The \"ok\" on the end is important. It is a way of letting you")
|
|
print_status("know that nessus used a self signed cert and the risk that presents.")
|
|
return
|
|
end
|
|
|
|
if ! @token == ''
|
|
print_error("You are already authenticated. Call nessus_logout before authing again")
|
|
return
|
|
end
|
|
|
|
if(args.length == 0 or args[0].empty?)
|
|
ncusage
|
|
return
|
|
end
|
|
|
|
@user = @pass = @host = @port = @sslv = nil
|
|
|
|
case args.length
|
|
when 1,2
|
|
if args[0].include? "@"
|
|
cred,targ = args[0].split('@', 2)
|
|
@user,@pass = cred.split(':', 2)
|
|
targ ||= '127.0.0.1:8834'
|
|
@host,@port = targ.split(':', 2)
|
|
@port ||= '8834'
|
|
@sslv = args[1]
|
|
else
|
|
@host,@port = args[0].split(':', 2)
|
|
@port ||= '8834'
|
|
@sslv = args[1]
|
|
end
|
|
|
|
when 3,4,5
|
|
ncusage
|
|
return
|
|
else
|
|
ncusage
|
|
return
|
|
end
|
|
|
|
if /\/\//.match(@host)
|
|
ncusage
|
|
return
|
|
end
|
|
|
|
if(@host != "localhost" and @host != "127.0.0.1" and @sslv != "ok")
|
|
print_error("Warning: SSL connections are not verified in this release, it is possible for an attacker")
|
|
print_error(" with the ability to man-in-the-middle the Nessus traffic to capture the Nessus")
|
|
print_error(" credentials. If you are running this on a trusted network, please pass in 'ok'")
|
|
print_error(" as an additional parameter to this command.")
|
|
return
|
|
end
|
|
|
|
if ! @user
|
|
print_error("Missing Username")
|
|
ncusage
|
|
return
|
|
end
|
|
|
|
if ! @pass
|
|
print_error("Missing Password")
|
|
ncusage
|
|
return
|
|
end
|
|
|
|
if ! ((@user and @user.length > 0) and (@host and @host.length > 0) and (@port and @port.length > 0 and @port.to_i > 0) and (@pass and @pass.length > 0))
|
|
ncusage
|
|
return
|
|
end
|
|
nessus_login
|
|
end
|
|
|
|
def nessus_login
|
|
|
|
if ! ((@user and @user.length > 0) and (@host and @host.length > 0) and (@port and @port.length > 0 and @port.to_i > 0) and (@pass and @pass.length > 0))
|
|
print_status("You need to connect to a server first.")
|
|
ncusage
|
|
return
|
|
end
|
|
|
|
@url = "https://#{@host}:#{@port}/"
|
|
print_status("Connecting to #{@url} as #{@user}")
|
|
@n=NessusXMLRPC::NessusXMLRPC.new(@url,@user,@pass)
|
|
@token=@n.login(@user,@pass)
|
|
if @n.logged_in
|
|
print_status("Authenticated")
|
|
else
|
|
print_error("Error connecting/logging to the server!")
|
|
return
|
|
end
|
|
end
|
|
|
|
def cmd_nessus_report_list(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_list")
|
|
print_status(" Example:> nessus_report_list")
|
|
print_status()
|
|
print_status("Generates a list of all reports visable to your user.")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
list=@n.report_list_hash
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'ID',
|
|
'Name',
|
|
'Status',
|
|
'Date'
|
|
])
|
|
|
|
list.each {|report|
|
|
t = Time.at(report['timestamp'].to_i)
|
|
tbl << [ report['id'], report['name'], report['status'], t.strftime("%H:%M %b %d %Y") ]
|
|
}
|
|
print_good("Nessus Report List")
|
|
print_good "\n"
|
|
print_line tbl.to_s + "\n"
|
|
print_status("You can:")
|
|
print_status(" Get a list of hosts from the report: nessus_report_hosts <report id>")
|
|
end
|
|
|
|
def check_scan(*args)
|
|
|
|
case args.length
|
|
when 1
|
|
rid = args[0]
|
|
else
|
|
print_error("No Report ID Supplied")
|
|
return
|
|
end
|
|
|
|
scans = @n.scan_list_hash
|
|
scans.each {|scan|
|
|
if scan['id'] == rid
|
|
return true
|
|
end
|
|
}
|
|
return false
|
|
end
|
|
|
|
def cmd_nessus_report_get(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_get <report id>")
|
|
print_status(" Example:> nessus_report_get f0eabba3-4065-7d54-5763-f191e98eb0f7f9f33db7e75a06ca")
|
|
print_status()
|
|
print_status("This command pulls the provided report from the nessus server in the nessusv2 format")
|
|
print_status("and parses it the same way db_import_nessus does. After it is parsed it will be")
|
|
print_status("available to commands such as db_hosts, db_vulns, db_services and db_autopwn.")
|
|
print_status("Use: nessus_report_list to obtain a list of report id's")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_db
|
|
return
|
|
end
|
|
|
|
if(args.length == 0 or args[0].empty? or args[0] == "-h")
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_get <report id> ")
|
|
print_status(" use nessus_report_list to list all available reports for importing")
|
|
return
|
|
end
|
|
|
|
rid = nil
|
|
|
|
case args.length
|
|
when 1
|
|
rid = args[0]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_get <report id> ")
|
|
print_status(" use nessus_report_list to list all available reports for importing")
|
|
return
|
|
end
|
|
|
|
if check_scan(rid)
|
|
print_error("That scan is still running.")
|
|
return
|
|
end
|
|
content = nil
|
|
content=@n.report_file_download(rid)
|
|
if content.nil?
|
|
print_error("Failed, please reauthenticate")
|
|
return
|
|
end
|
|
print_status("importing " + rid)
|
|
framework.db.import({:data => content}) do |type,data|
|
|
case type
|
|
when :address
|
|
print_line("%bld%blu[*]%clr %bld#{data}%clr")
|
|
end
|
|
end
|
|
print_good("Done")
|
|
end
|
|
|
|
def cmd_nessus_scan_status(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_status")
|
|
print_status(" Example:> nessus_scan_status")
|
|
print_status()
|
|
print_status("Returns a list of information about currently running scans.")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
list=@n.scan_list_hash
|
|
if list.empty?
|
|
print_status("No Scans Running.")
|
|
print_status("You can:")
|
|
print_status(" List of completed scans: nessus_report_list")
|
|
print_status(" Create a scan: nessus_scan_new <policy id> <scan name> <target(s)>")
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Scan ID',
|
|
'Name',
|
|
'Owner',
|
|
'Started',
|
|
'Status',
|
|
'Current Hosts',
|
|
'Total Hosts'
|
|
])
|
|
|
|
list.each {|scan|
|
|
t = Time.at(scan['start'].to_i)
|
|
tbl << [ scan['id'], scan['name'], scan['owner'], t.strftime("%H:%M %b %d %Y"), scan['status'], scan['current'], scan['total'] ]
|
|
}
|
|
print_good("Running Scans")
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
print_good "\n"
|
|
print_status("You can:")
|
|
print_good(" Import Nessus report to database : nessus_report_get <reportid>")
|
|
print_good(" Pause a nessus scan : nessus_scan_pause <scanid>")
|
|
end
|
|
|
|
def cmd_nessus_template_list(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_template_list")
|
|
print_status(" Example:> nessus_template_list")
|
|
print_status()
|
|
print_status("Returns a list of information about the server templates..")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
list=@n.template_list_hash
|
|
|
|
if list.empty?
|
|
print_status("No Templates Created.")
|
|
print_status("You can:")
|
|
print_status(" List of completed scans: nessus_report_list")
|
|
print_status(" Create a template: nessus_template_new <policy id> <scan name> <target(s)>")
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Template ID',
|
|
'Policy ID',
|
|
'Name',
|
|
'Owner',
|
|
'Target'
|
|
])
|
|
|
|
list.each {|template|
|
|
tbl << [ template['name'], template['pid'], template['rname'], template['owner'], template['target'] ]
|
|
}
|
|
print_good("Templates")
|
|
print_good "\n"
|
|
print_line tbl.to_s + "\n"
|
|
print_good "\n"
|
|
print_status("You can:")
|
|
print_good(" Import Nessus report to database : nessus_report_get <reportid>")
|
|
end
|
|
|
|
def cmd_nessus_user_list(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_user_list")
|
|
print_status(" Example:> nessus_user_list")
|
|
print_status()
|
|
print_status("Returns a list of the users on the Nessus server and their access level.")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
if ! @n.is_admin
|
|
print_status("Your Nessus user is not an admin")
|
|
end
|
|
|
|
list=@n.users_list
|
|
print_good("There are #{list.length} users")
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Name',
|
|
'Is Admin?',
|
|
'Last Login'
|
|
])
|
|
|
|
list.each {|user|
|
|
t = Time.at(user['lastlogin'].to_i)
|
|
tbl << [ user['name'], user['admin'], t.strftime("%H:%M %b %d %Y") ]
|
|
}
|
|
print_good("Nessus users")
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
end
|
|
|
|
def cmd_nessus_server_status(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_server_status")
|
|
print_status(" Example:> nessus_server_status")
|
|
print_status()
|
|
print_status("Returns some status items for the server..")
|
|
return
|
|
end
|
|
#Auth
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
#Check if we are an admin
|
|
if ! @n.is_admin
|
|
print_status("You need to be an admin for this.")
|
|
return
|
|
end
|
|
|
|
#Versions
|
|
cmd_nessus_server_feed
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Users',
|
|
'Policies',
|
|
'Running Scans',
|
|
'Reports',
|
|
'Plugins'
|
|
])
|
|
#Count how many users the server has.
|
|
list=@n.users_list
|
|
users = list.length
|
|
|
|
#Count how many policies
|
|
list=@n.policy_list_hash
|
|
policies = list.length
|
|
|
|
#Count how many running scans
|
|
list=@n.scan_list_uids
|
|
scans = list.length
|
|
|
|
#Count how many reports are available
|
|
list=@n.report_list_hash
|
|
reports = list.length
|
|
|
|
#Count how many plugins
|
|
list=@n.plugins_list
|
|
total = Array.new
|
|
list.each {|plugin|
|
|
total.push(plugin['num'].to_i)
|
|
}
|
|
plugins = total.sum
|
|
tbl << [users, policies, scans, reports, plugins]
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
end
|
|
|
|
def cmd_nessus_plugin_list(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_plugin_list")
|
|
print_status(" Example:> nessus_plugin_list")
|
|
print_status()
|
|
print_status("Returns a list of the plugins on the server per family.")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Family Name',
|
|
'Total Plugins'
|
|
])
|
|
list=@n.plugins_list
|
|
total = Array.new
|
|
list.each {|plugin|
|
|
total.push(plugin['num'].to_i)
|
|
tbl << [ plugin['name'], plugin['num'] ]
|
|
}
|
|
plugins = total.sum
|
|
tbl << [ '', '']
|
|
tbl << [ 'Total Plugins', plugins ]
|
|
print_good("Plugins By Family")
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
print_status("List plugins for a family : nessus_plugin_family <family name>")
|
|
end
|
|
|
|
def check_policy(*args)
|
|
|
|
case args.length
|
|
when 1
|
|
pid = args[0]
|
|
else
|
|
print_error("No Policy ID supplied.")
|
|
return
|
|
end
|
|
|
|
pol = @n.policy_list_hash
|
|
pol.each {|p|
|
|
if p['id'].to_i == pid
|
|
return false
|
|
end
|
|
}
|
|
return true
|
|
end
|
|
|
|
def cmd_nessus_scan_new(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_new <policy id> <scan name> <targets>")
|
|
print_status(" Example:> nessus_scan_new 1 \"My Scan\" 192.168.1.250")
|
|
print_status()
|
|
print_status("Creates a scan based on a policy id and targets.")
|
|
print_status("use nessus_policy_list to list all available policies")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 3
|
|
pid = args[0].to_i
|
|
name = args[1]
|
|
tgts = args[2]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_new <policy id> <scan name> <targets>")
|
|
print_status(" use nessus_policy_list to list all available policies")
|
|
return
|
|
end
|
|
|
|
if check_policy(pid)
|
|
print_error("That policy does not exist.")
|
|
return
|
|
end
|
|
|
|
print_status("Creating scan from policy number #{pid}, called \"#{name}\" and scanning #{tgts}")
|
|
|
|
scan = @n.scan_new(pid, name, tgts)
|
|
|
|
if scan
|
|
print_status("Scan started. uid is #{scan}")
|
|
end
|
|
end
|
|
|
|
def cmd_nessus_scan_pause(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_pause <scan id>")
|
|
print_status(" Example:> nessus_scan_pause f0eabba3-4065-7d54-5763-f191e98eb0f7f9f33db7e75a06ca")
|
|
print_status()
|
|
print_status("Pauses a running scan")
|
|
print_status("use nessus_scan_status to list all available scans")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 1
|
|
sid = args[0]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_pause <scan id>")
|
|
print_status(" use nessus_scan_status to list all available scans")
|
|
return
|
|
end
|
|
|
|
pause = @n.scan_pause(sid)
|
|
|
|
print_status("#{sid} has been paused")
|
|
end
|
|
|
|
def cmd_nessus_scan_resume(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_resume <scan id>")
|
|
print_status(" Example:> nessus_scan_resume f0eabba3-4065-7d54-5763-f191e98eb0f7f9f33db7e75a06ca")
|
|
print_status()
|
|
print_status("resumes a running scan")
|
|
print_status("use nessus_scan_status to list all available scans")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 1
|
|
sid = args[0]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_resume <scan id>")
|
|
print_status(" use nessus_scan_status to list all available scans")
|
|
return
|
|
end
|
|
|
|
resume = @n.scan_resume(sid)
|
|
|
|
print_status("#{sid} has been resumed")
|
|
end
|
|
|
|
def cmd_nessus_report_hosts(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_hosts <report id>")
|
|
print_status(" Example:> nessus_report_hosts f0eabba3-4065-7d54-5763-f191e98eb0f7f9f33db7e75a06ca")
|
|
print_status()
|
|
print_status("Returns all the hosts associated with a scan and details about their vulnerabilities")
|
|
print_status("use nessus_report_list to list all available scans")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 1
|
|
rid = args[0]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_hosts <report id>")
|
|
print_status(" use nessus_report_list to list all available reports")
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Hostname',
|
|
'Severity',
|
|
'Sev 0',
|
|
'Sev 1',
|
|
'Sev 2',
|
|
'Sev 3',
|
|
'Current Progress',
|
|
'Total Progress'
|
|
])
|
|
hosts=@n.report_hosts(rid)
|
|
hosts.each {|host|
|
|
tbl << [ host['hostname'], host['severity'], host['sev0'], host['sev1'], host['sev2'], host['sev3'], host['current'], host['total'] ]
|
|
}
|
|
print_good("Report Info")
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
print_status("You can:")
|
|
print_status(" Get information from a particular host: nessus_report_host_ports <hostname> <report id>")
|
|
end
|
|
|
|
def cmd_nessus_report_vulns(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_vulns <report id>")
|
|
print_status(" Example:> nessus_report_vulns f0eabba3-4065-7d54-5763-f191e98eb0f7f9f33db7e75a06ca")
|
|
print_status()
|
|
print_status("Returns all the vulns associated with a scan and details about hosts and their vulnerabilities")
|
|
print_status("use nessus_report_list to list all available scans")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 1
|
|
rid = args[0]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_vulns <report id>")
|
|
print_status(" use nessus_report_vulns to list all available reports")
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Hostname',
|
|
'Port',
|
|
'Proto',
|
|
'Sev',
|
|
'PluginID',
|
|
'Plugin Name'
|
|
])
|
|
print_status("Grabbing all vulns for report #{rid}")
|
|
hosts=@n.report_hosts(rid)
|
|
hosts.each do |host|
|
|
ports=@n.report_host_ports(rid, host['hostname'])
|
|
ports.each do |port|
|
|
details=@n.report_host_port_details(rid, host['hostname'], port['portnum'], port['protocol'])
|
|
details.each do |detail|
|
|
tbl << [host['hostname'],
|
|
port['portnum'],
|
|
port['protocol'],
|
|
detail['severity'],
|
|
detail['pluginID'],
|
|
detail['pluginName']
|
|
]
|
|
end
|
|
end
|
|
end
|
|
print_good("Report Info")
|
|
print_line
|
|
print_line tbl.to_s
|
|
print_status("You can:")
|
|
print_status(" Get information from a particular host: nessus_report_host_ports <hostname> <report id>")
|
|
end
|
|
|
|
def cmd_nessus_report_host_ports(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_host_ports <hostname> <report id>")
|
|
print_status(" Example:> nessus_report_host_ports 192.168.1.250 f0eabba3-4065-7d54-5763-f191e98eb0f7f9f33db7e75a06ca")
|
|
print_status()
|
|
print_status("Returns all the ports associated with a host and details about their vulnerabilities")
|
|
print_status("use nessus_report_hosts to list all available hosts for a report")
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 2
|
|
host = args[0]
|
|
rid = args[1]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_host_ports <hostname> <report id>")
|
|
print_status(" use nessus_report_list to list all available reports")
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Port',
|
|
'Protocol',
|
|
'Severity',
|
|
'Service Name',
|
|
'Sev 0',
|
|
'Sev 1',
|
|
'Sev 2',
|
|
'Sev 3'
|
|
])
|
|
ports=@n.report_host_ports(rid, host)
|
|
ports.each {|port|
|
|
tbl << [ port['portnum'], port['protocol'], port['severity'], port['svcname'], port['sev0'], port['sev1'], port['sev2'], port['sev3'] ]
|
|
}
|
|
print_good("Host Info")
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
print_status("You can:")
|
|
print_status(" Get detailed scan infromation about a specfic port: nessus_report_host_detail <hostname> <port> <protocol> <report id>")
|
|
end
|
|
|
|
def cmd_nessus_report_host_detail(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_host_detail <hostname> <port> <protocol> <report id>")
|
|
print_status(" Example:> nessus_report_host_ports 192.168.1.250 445 tcp f0eabba3-4065-7d54-5763-f191e98eb0f7f9f33db7e75a06ca")
|
|
print_status()
|
|
print_status("Returns all the vulns associated with a port for a specific host")
|
|
print_status("use nessus_report_host_ports to list all available ports for a host")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 4
|
|
host = args[0]
|
|
port = args[1]
|
|
prot = args[2]
|
|
rid = args[3]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_host_detail <hostname> <port> <protocol> <report id>")
|
|
print_status(" use nessus_report_host_ports to list all available ports")
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Port',
|
|
'Severity',
|
|
'PluginID',
|
|
'Plugin Name',
|
|
'CVSS2',
|
|
'Exploit?',
|
|
'CVE',
|
|
'Risk Factor',
|
|
'CVSS Vector'
|
|
])
|
|
details=@n.report_host_port_details(rid, host, port, prot)
|
|
details.each {|detail|
|
|
tbl << [
|
|
detail['port'],
|
|
detail['severity'],
|
|
detail['pluginID'],
|
|
detail['pluginName'],
|
|
detail['cvss_base_score'] || 'none',
|
|
detail['exploit_available'] || '.',
|
|
detail['cve'] || '.',
|
|
detail['risk_factor'] || '.',
|
|
detail['cvss_vector'] || '.'
|
|
]
|
|
}
|
|
print_good("Port Info")
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
end
|
|
|
|
def cmd_nessus_scan_pause_all(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_pause_all")
|
|
print_status(" Example:> nessus_scan_pause_all")
|
|
print_status()
|
|
print_status("Pauses all currently running scans")
|
|
print_status("use nessus_scan_list to list all running scans")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
pause = @n.scan_pause_all
|
|
|
|
print_status("All scans have been paused")
|
|
end
|
|
|
|
def cmd_nessus_scan_stop(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_stop <scan id>")
|
|
print_status(" Example:> nessus_scan_stop f0eabba3-4065-7d54-5763-f191e98eb0f7f9f33db7e75a06ca")
|
|
print_status()
|
|
print_status("Stops a currently running scans")
|
|
print_status("use nessus_scan_list to list all running scans")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 1
|
|
sid = args[0]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_stop <scan id>")
|
|
print_status(" use nessus_scan_status to list all available scans")
|
|
return
|
|
end
|
|
|
|
pause = @n.scan_stop(sid)
|
|
|
|
print_status("#{sid} has been stopped")
|
|
end
|
|
|
|
def cmd_nessus_scan_stop_all(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_stop_all")
|
|
print_status(" Example:> nessus_scan_stop_all")
|
|
print_status()
|
|
print_status("stops all currently running scans")
|
|
print_status("use nessus_scan_list to list all running scans")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
pause = @n.scan_stop_all
|
|
|
|
print_status("All scans have been stopped")
|
|
end
|
|
|
|
def cmd_nessus_scan_resume_all(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_scan_resume_all")
|
|
print_status(" Example:> nessus_scan_resume_all")
|
|
print_status()
|
|
print_status("resumes all currently running scans")
|
|
print_status("use nessus_scan_list to list all running scans")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
pause = @n.scan_resume_all
|
|
|
|
print_status("All scans have been resumed")
|
|
end
|
|
|
|
def cmd_nessus_user_add(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_user_add <username> <password>")
|
|
print_status(" Example:> nessus_user_add msf msf")
|
|
print_status()
|
|
print_status("Only adds non admin users. Must be an admin to add users.")
|
|
print_status("use nessus_user_list to list all users")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
if ! @n.is_admin
|
|
print_error("Your Nessus user is not an admin")
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 2
|
|
user = args[0]
|
|
pass = args[1]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_user_add <username> <password>")
|
|
print_status(" Only adds non admin users")
|
|
return
|
|
end
|
|
|
|
u = @n.users_list
|
|
u.each { |stuff|
|
|
if stuff['name'] == user
|
|
print_error("That user exists")
|
|
return
|
|
end
|
|
}
|
|
add = @n.user_add(user,pass)
|
|
status = add.root.elements['status'].text if add
|
|
if status == "OK"
|
|
print_good("#{user} has been added")
|
|
else
|
|
print_error("#{user} was not added")
|
|
end
|
|
end
|
|
|
|
def cmd_nessus_user_del(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_user_del <username>")
|
|
print_status(" Example:> nessus_user_del msf")
|
|
print_status()
|
|
print_status("Only dels non admin users. Must be an admin to del users.")
|
|
print_status("use nessus_user_list to list all users")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
if ! @n.is_admin
|
|
print_error("Your Nessus user is not an admin")
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 1
|
|
user = args[0]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_user_del <username>")
|
|
print_status(" Only dels non admin users")
|
|
return
|
|
end
|
|
|
|
del = @n.user_del(user)
|
|
status = del.root.elements['status'].text
|
|
if status == "OK"
|
|
print_good("#{user} has been deleted")
|
|
else
|
|
print_error("#{user} was not deleted")
|
|
end
|
|
end
|
|
|
|
def cmd_nessus_user_passwd(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_user_passwd <username> <password>")
|
|
print_status(" Example:> nessus_user_passwd msf newpassword")
|
|
print_status()
|
|
print_status("Changes the password of a user. Must be an admin to change passwords.")
|
|
print_status("use nessus_user_list to list all users")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
if ! @n.is_admin
|
|
print_error("Your Nessus user is not an admin")
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 2
|
|
user = args[0]
|
|
pass = args[1]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_user_passwd <username> <password>")
|
|
print_status(" User list from nessus_user_list")
|
|
return
|
|
end
|
|
|
|
pass = @n.user_pass(user,pass)
|
|
status = pass.root.elements['status'].text
|
|
if status == "OK"
|
|
print_good("#{user}'s password has been changed")
|
|
else
|
|
print_error("#{user}'s password has not been changed")
|
|
end
|
|
end
|
|
|
|
def cmd_nessus_admin(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_admin")
|
|
print_status(" Example:> nessus_admin")
|
|
print_status()
|
|
print_status("Checks to see if the current user is an admin")
|
|
print_status("use nessus_user_list to list all users")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
if ! @n.is_admin
|
|
print_error("Your Nessus user is not an admin")
|
|
else
|
|
print_good("Your Nessus user is an admin")
|
|
end
|
|
end
|
|
|
|
def cmd_nessus_plugin_family(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_plugin_family <plugin family name>")
|
|
print_status(" Example:> nessus_plugin_family \"Windows : Microsoft Bulletins\" ")
|
|
print_status()
|
|
print_status("Returns a list of all plugins in that family.")
|
|
print_status("use nessus_plugin_list to list all plugins")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 1
|
|
fam = args[0]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_plugin_family <plugin family name>")
|
|
print_status(" list all plugins from a Family from nessus_plugin_list")
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Plugin ID',
|
|
'Plugin Name',
|
|
'Plugin File Name'
|
|
])
|
|
|
|
family = @n.plugin_family(fam)
|
|
|
|
family.each {|plugin|
|
|
tbl << [ plugin['id'], plugin['name'], plugin['filename'] ]
|
|
}
|
|
print_good("#{fam} Info")
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
end
|
|
|
|
def cmd_nessus_policy_list(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_policy_list")
|
|
print_status(" Example:> nessus_policy_list")
|
|
print_status()
|
|
print_status("Lists all policies on the server")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'ID',
|
|
'Name',
|
|
'Comments'
|
|
])
|
|
list=@n.policy_list_hash
|
|
list.each {|policy|
|
|
tbl << [ policy['id'], policy['name'], policy['comments'] ]
|
|
}
|
|
print_good("Nessus Policy List")
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
end
|
|
|
|
def cmd_nessus_policy_del(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_policy_del <policy ID>")
|
|
print_status(" Example:> nessus_policy_del 1")
|
|
print_status()
|
|
print_status("Must be an admin to del policies.")
|
|
print_status("use nessus_policy_list to list all policies")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
if ! @n.is_admin
|
|
print_error("Your Nessus user is not an admin")
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 1
|
|
pid = args[0]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_policy_del <policy ID>")
|
|
print_status(" nessus_policy_list to find the id.")
|
|
return
|
|
end
|
|
|
|
|
|
del = @n.policy_del(pid)
|
|
status = del.root.elements['status'].text
|
|
if status == "OK"
|
|
print_good("Policy number #{pid} has been deleted")
|
|
else
|
|
print_error("Policy number #{pid} was not deleted")
|
|
end
|
|
|
|
end
|
|
|
|
def cmd_nessus_plugin_details(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_plugin_details <plugin file name>")
|
|
print_status(" Example:> nessus_plugin_details ping_host.nasl ")
|
|
print_status()
|
|
print_status("Returns details on a particular plugin.")
|
|
print_status("use nessus_plugin_list to list all plugins")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 1
|
|
pname = args[0]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_policy_del <plugin file name>")
|
|
print_status(" nessus_plugin_list and then nessus_plugin_family to find the plugin file name.")
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'',
|
|
''
|
|
])
|
|
|
|
entry = @n.plugin_detail(pname)
|
|
print_good("Plugin Details for #{entry['name']}")
|
|
tbl << [ "Plugin ID", entry['id'] ]
|
|
tbl << [ "Plugin Family", entry['family'] ]
|
|
tbl << [ "CVSS Base Score", entry['cvss_base_score'] ]
|
|
tbl << [ "CVSS Vector", entry['cvss_vector'] ]
|
|
tbl << [ "CVSS Temporal Score", entry['cvss_temporal_score'] ]
|
|
tbl << [ "CVSS Temporal Vector", entry['cvss_temporal_vector'] ]
|
|
tbl << [ "Risk Factor", entry['risk_factor'] ]
|
|
tbl << [ "Exploit Available", entry['exploit_available'] ]
|
|
tbl << [ "Exploitability Ease", entry['exploit_ease'] ]
|
|
tbl << [ "Synopsis", entry['synopsis'] ]
|
|
tbl << [ "Description", entry['description'] ]
|
|
tbl << [ "Solution", entry['solution'] ]
|
|
tbl << [ "Plugin Pub Date", entry['plugin_publication_date'] ]
|
|
tbl << [ "Plugin Modification Date", entry['plugin_modification_date'] ]
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
end
|
|
|
|
def cmd_nessus_report_del(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_del <reportname>")
|
|
print_status(" Example:> nessus_report_del f0eabba3-4065-7d54-5763-f191e98eb0f7f9f33db7e75a06ca")
|
|
print_status()
|
|
print_status("Must be an admin to del reports.")
|
|
print_status("use nessus_report_list to list all reports")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
if ! @n.is_admin
|
|
print_error("Your Nessus user is not an admin")
|
|
return
|
|
end
|
|
|
|
case args.length
|
|
when 1
|
|
rid = args[0]
|
|
else
|
|
print_status("Usage: ")
|
|
print_status(" nessus_report_del <report ID>")
|
|
print_status(" nessus_report_list to find the id.")
|
|
return
|
|
end
|
|
|
|
|
|
del = @n.report_del(rid)
|
|
status = del.root.elements['status'].text
|
|
if status == "OK"
|
|
print_good("Report #{rid} has been deleted")
|
|
else
|
|
print_error("Report #{rid} was not deleted")
|
|
end
|
|
end
|
|
|
|
def cmd_nessus_server_prefs(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_server_prefs")
|
|
print_status(" Example:> nessus_server_prefs")
|
|
print_status()
|
|
print_status("Returns a long list of server prefs.")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
if ! @n.is_admin
|
|
print_error("Your Nessus user is not an admin")
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Name',
|
|
'Value'
|
|
])
|
|
prefs = @n.server_prefs
|
|
prefs.each {|pref|
|
|
tbl << [ pref['name'], pref['value'] ]
|
|
}
|
|
print_good("Nessus Server Pref List")
|
|
print_good "\n"
|
|
print_line tbl.to_s + "\n"
|
|
|
|
end
|
|
|
|
def cmd_nessus_plugin_prefs(*args)
|
|
|
|
if args[0] == "-h"
|
|
print_status("Usage: ")
|
|
print_status(" nessus_plugin_prefs")
|
|
print_status(" Example:> nessus_plugin_prefs")
|
|
print_status()
|
|
print_status("Returns a long list of plugin prefs.")
|
|
return
|
|
end
|
|
|
|
if ! nessus_verify_token
|
|
return
|
|
end
|
|
|
|
if ! @n.is_admin
|
|
print_error("Your Nessus user is not an admin")
|
|
return
|
|
end
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Columns' => [
|
|
'Name',
|
|
'Value',
|
|
'Type'
|
|
])
|
|
prefs = @n.plugin_prefs
|
|
prefs.each {|pref|
|
|
tbl << [ pref['prefname'], pref['prefvalues'], pref['preftype'] ]
|
|
}
|
|
print_good("Nessus Plugins Pref List")
|
|
print_good "\n"
|
|
print_line tbl.to_s
|
|
end
|
|
end
|
|
|
|
def initialize(framework, opts)
|
|
super
|
|
|
|
add_console_dispatcher(ConsoleCommandDispatcher)
|
|
@nbver = "1.1" # Nessus Plugin Version. Increments each time we commit to msf
|
|
@xindex = "#{Msf::Config.get_config_root}/nessus_index" # location of the exploit index file used to speed up searching for valid exploits.
|
|
@nessus_yaml = "#{Msf::Config.get_config_root}/nessus.yaml" #location of the nessus.yml containing saved nessus creds
|
|
print_status("Nessus Bridge for Metasploit #{@nbver}")
|
|
print_good("Type %bldnessus_help%clr for a command listing")
|
|
#nessus_index
|
|
end
|
|
|
|
def cleanup
|
|
remove_console_dispatcher('Nessus')
|
|
end
|
|
|
|
def name
|
|
"nessus"
|
|
end
|
|
|
|
def desc
|
|
"Nessus Bridge for Metasploit #{@nbver}"
|
|
end
|
|
protected
|
|
end
|
|
end
|