Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 11a7a0c

Browse files
takuzoo3868kotakanbe
takuzoo3868
and
kotakanbe
authoredJul 3, 2020
Display metasploit module information for each detected CVE-IDs (future-architect#1011)
* add metasploit * fix go deps * fix msf report * fix msfdb server port number * delete non-unique msfdb url from fulltext report * fix(report): validate msfdb config on report (future-architect#1) * fix(msfdb): update deps (go-msfdb) * version up go-msfdb v0.1.0 Co-authored-by: Kota Kanbe <kotakanbe@gmail.com>
1 parent 89f49b0 commit 11a7a0c

15 files changed

+539
-87
lines changed
 

‎commands/discover.go

+5
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,11 @@ type = "sqlite3"
9595
sqlite3Path = "/path/to/go-exploitdb.sqlite3"
9696
#url = ""
9797
98+
[metasploit]
99+
type = "sqlite3"
100+
sqlite3Path = "/path/to/go-msfdb.sqlite3"
101+
#url = ""
102+
98103
# https://vuls.io/docs/en/usage-settings.html#slack-section
99104
#[slack]
100105
#hookURL = "https://hooks.slack.com/services/abc123/defghijklmnopqrstuvwxyz"

‎commands/report.go

+33-11
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"github.com/future-architect/vuls/exploit"
1212
"github.com/future-architect/vuls/gost"
1313
"github.com/future-architect/vuls/models"
14+
"github.com/future-architect/vuls/msf"
1415
"github.com/future-architect/vuls/oval"
1516
"github.com/future-architect/vuls/report"
1617
"github.com/future-architect/vuls/util"
@@ -21,12 +22,13 @@ import (
2122

2223
// ReportCmd is subcommand for reporting
2324
type ReportCmd struct {
24-
configPath string
25-
cveDict c.GoCveDictConf
26-
ovalDict c.GovalDictConf
27-
gostConf c.GostConf
28-
exploitConf c.ExploitConf
29-
httpConf c.HTTPConf
25+
configPath string
26+
cveDict c.GoCveDictConf
27+
ovalDict c.GovalDictConf
28+
gostConf c.GostConf
29+
exploitConf c.ExploitConf
30+
metasploitConf c.MetasploitConf
31+
httpConf c.HTTPConf
3032
}
3133

3234
// Name return subcommand name
@@ -87,6 +89,9 @@ func (*ReportCmd) Usage() string {
8789
[-exploitdb-type=sqlite3|mysql|redis|http]
8890
[-exploitdb-sqlite3-path=/path/to/exploitdb.sqlite3]
8991
[-exploitdb-url=http://127.0.0.1:1326 or DB connection string]
92+
[-msfdb-type=sqlite3|mysql|redis|http]
93+
[-msfdb-sqlite3-path=/path/to/msfdb.sqlite3]
94+
[-msfdb-url=http://127.0.0.1:1327 or DB connection string]
9095
[-http="http://vuls-report-server"]
9196
[-trivy-cachedb-dir=/path/to/dir]
9297
@@ -192,6 +197,12 @@ func (p *ReportCmd) SetFlags(f *flag.FlagSet) {
192197
f.StringVar(&p.exploitConf.URL, "exploitdb-url", "",
193198
"http://exploit.com:1326 or DB connection string")
194199

200+
f.StringVar(&p.metasploitConf.Type, "msfdb-type", "",
201+
"DB type of msf (sqlite3, mysql, postgres, redis or http)")
202+
f.StringVar(&p.metasploitConf.SQLite3Path, "msfdb-sqlite3-path", "", "/path/to/sqlite3")
203+
f.StringVar(&p.metasploitConf.URL, "msfdb-url", "",
204+
"http://metasploit.com:1327 or DB connection string")
205+
195206
f.StringVar(&p.httpConf.URL, "http", "", "-to-http http://vuls-report")
196207

197208
f.StringVar(&c.Conf.TrivyCacheDBDir, "trivy-cachedb-dir",
@@ -212,6 +223,7 @@ func (p *ReportCmd) Execute(_ context.Context, f *flag.FlagSet, _ ...interface{}
212223
c.Conf.OvalDict.Overwrite(p.ovalDict)
213224
c.Conf.Gost.Overwrite(p.gostConf)
214225
c.Conf.Exploit.Overwrite(p.exploitConf)
226+
c.Conf.Metasploit.Overwrite(p.metasploitConf)
215227
c.Conf.HTTP.Overwrite(p.httpConf)
216228

217229
var dir string
@@ -395,12 +407,22 @@ func (p *ReportCmd) Execute(_ context.Context, f *flag.FlagSet, _ ...interface{}
395407
return subcommands.ExitFailure
396408
}
397409
}
410+
411+
if c.Conf.Metasploit.URL != "" {
412+
err := msf.CheckHTTPHealth()
413+
if err != nil {
414+
util.Log.Errorf("metasploit HTTP server is not running. err: %+v", err)
415+
util.Log.Errorf("Run go-msfdb as server mode before reporting")
416+
return subcommands.ExitFailure
417+
}
418+
}
398419
dbclient, locked, err := report.NewDBClient(report.DBClientConf{
399-
CveDictCnf: c.Conf.CveDict,
400-
OvalDictCnf: c.Conf.OvalDict,
401-
GostCnf: c.Conf.Gost,
402-
ExploitCnf: c.Conf.Exploit,
403-
DebugSQL: c.Conf.DebugSQL,
420+
CveDictCnf: c.Conf.CveDict,
421+
OvalDictCnf: c.Conf.OvalDict,
422+
GostCnf: c.Conf.Gost,
423+
ExploitCnf: c.Conf.Exploit,
424+
MetasploitCnf: c.Conf.Metasploit,
425+
DebugSQL: c.Conf.DebugSQL,
404426
})
405427
if locked {
406428
util.Log.Errorf("SQLite3 is locked. Close other DB connections and try again. err: %+v", err)

‎commands/server.go

+32-11
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
c "github.com/future-architect/vuls/config"
1414
"github.com/future-architect/vuls/exploit"
1515
"github.com/future-architect/vuls/gost"
16+
"github.com/future-architect/vuls/msf"
1617
"github.com/future-architect/vuls/oval"
1718
"github.com/future-architect/vuls/report"
1819
"github.com/future-architect/vuls/server"
@@ -23,12 +24,13 @@ import (
2324

2425
// ServerCmd is subcommand for server
2526
type ServerCmd struct {
26-
configPath string
27-
listen string
28-
cveDict c.GoCveDictConf
29-
ovalDict c.GovalDictConf
30-
gostConf c.GostConf
31-
exploitConf c.ExploitConf
27+
configPath string
28+
listen string
29+
cveDict c.GoCveDictConf
30+
ovalDict c.GovalDictConf
31+
gostConf c.GostConf
32+
exploitConf c.ExploitConf
33+
metasploitConf c.MetasploitConf
3234
}
3335

3436
// Name return subcommand name
@@ -65,6 +67,9 @@ func (*ServerCmd) Usage() string {
6567
[-exploitdb-type=sqlite3|mysql|redis|http]
6668
[-exploitdb-sqlite3-path=/path/to/exploitdb.sqlite3]
6769
[-exploitdb-url=http://127.0.0.1:1326 or DB connection string]
70+
[-msfdb-type=sqlite3|mysql|redis|http]
71+
[-msfdb-sqlite3-path=/path/to/msfdb.sqlite3]
72+
[-msfdb-url=http://127.0.0.1:1327 or DB connection string]
6873
6974
[RFC3339 datetime format under results dir]
7075
`
@@ -126,6 +131,12 @@ func (p *ServerCmd) SetFlags(f *flag.FlagSet) {
126131
f.StringVar(&p.exploitConf.SQLite3Path, "exploitdb-sqlite3-path", "", "/path/to/sqlite3")
127132
f.StringVar(&p.exploitConf.URL, "exploitdb-url", "",
128133
"http://exploit.com:1326 or DB connection string")
134+
135+
f.StringVar(&p.metasploitConf.Type, "msfdb-type", "",
136+
"DB type of msf (sqlite3, mysql, postgres, redis or http)")
137+
f.StringVar(&p.metasploitConf.SQLite3Path, "msfdb-sqlite3-path", "", "/path/to/sqlite3")
138+
f.StringVar(&p.metasploitConf.URL, "msfdb-url", "",
139+
"http://metasploit.com:1327 or DB connection string")
129140
}
130141

131142
// Execute execute
@@ -144,6 +155,7 @@ func (p *ServerCmd) Execute(_ context.Context, f *flag.FlagSet, _ ...interface{}
144155
c.Conf.OvalDict.Overwrite(p.ovalDict)
145156
c.Conf.Gost.Overwrite(p.gostConf)
146157
c.Conf.Exploit.Overwrite(p.exploitConf)
158+
c.Conf.Metasploit.Overwrite(p.metasploitConf)
147159

148160
util.Log.Info("Validating config...")
149161
if !c.Conf.ValidateOnReport() {
@@ -191,12 +203,21 @@ func (p *ServerCmd) Execute(_ context.Context, f *flag.FlagSet, _ ...interface{}
191203
}
192204
}
193205

206+
if c.Conf.Metasploit.URL != "" {
207+
err := msf.CheckHTTPHealth()
208+
if err != nil {
209+
util.Log.Errorf("metasploit HTTP server is not running. err: %+v", err)
210+
util.Log.Errorf("Run go-msfdb as server mode before reporting")
211+
return subcommands.ExitFailure
212+
}
213+
}
194214
dbclient, locked, err := report.NewDBClient(report.DBClientConf{
195-
CveDictCnf: c.Conf.CveDict,
196-
OvalDictCnf: c.Conf.OvalDict,
197-
GostCnf: c.Conf.Gost,
198-
ExploitCnf: c.Conf.Exploit,
199-
DebugSQL: c.Conf.DebugSQL,
215+
CveDictCnf: c.Conf.CveDict,
216+
OvalDictCnf: c.Conf.OvalDict,
217+
GostCnf: c.Conf.Gost,
218+
ExploitCnf: c.Conf.Exploit,
219+
MetasploitCnf: c.Conf.Metasploit,
220+
DebugSQL: c.Conf.DebugSQL,
200221
})
201222
if locked {
202223
util.Log.Errorf("SQLite3 is locked. Close other DB connections and try again: %+v", err)

‎commands/tui.go

+32-10
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"github.com/future-architect/vuls/exploit"
1212
"github.com/future-architect/vuls/gost"
1313
"github.com/future-architect/vuls/models"
14+
"github.com/future-architect/vuls/msf"
1415
"github.com/future-architect/vuls/oval"
1516
"github.com/future-architect/vuls/report"
1617
"github.com/future-architect/vuls/util"
@@ -20,11 +21,12 @@ import (
2021

2122
// TuiCmd is Subcommand of host discovery mode
2223
type TuiCmd struct {
23-
configPath string
24-
cveDict c.GoCveDictConf
25-
ovalDict c.GovalDictConf
26-
gostConf c.GostConf
27-
exploitConf c.ExploitConf
24+
configPath string
25+
cveDict c.GoCveDictConf
26+
ovalDict c.GovalDictConf
27+
gostConf c.GostConf
28+
exploitConf c.ExploitConf
29+
metasploitConf c.MetasploitConf
2830
}
2931

3032
// Name return subcommand name
@@ -62,6 +64,9 @@ func (*TuiCmd) Usage() string {
6264
[-exploitdb-type=sqlite3|mysql|redis|http]
6365
[-exploitdb-sqlite3-path=/path/to/exploitdb.sqlite3]
6466
[-exploitdb-url=http://127.0.0.1:1326 or DB connection string]
67+
[-msfdb-type=sqlite3|mysql|redis|http]
68+
[-msfdb-sqlite3-path=/path/to/msfdb.sqlite3]
69+
[-msfdb-url=http://127.0.0.1:1327 or DB connection string]
6570
[-trivy-cachedb-dir=/path/to/dir]
6671
6772
`
@@ -127,6 +132,12 @@ func (p *TuiCmd) SetFlags(f *flag.FlagSet) {
127132
f.StringVar(&p.exploitConf.URL, "exploitdb-url", "",
128133
"http://exploit.com:1326 or DB connection string")
129134

135+
f.StringVar(&p.metasploitConf.Type, "msfdb-type", "",
136+
"DB type of msf (sqlite3, mysql, postgres, redis or http)")
137+
f.StringVar(&p.metasploitConf.SQLite3Path, "msfdb-sqlite3-path", "", "/path/to/sqlite3")
138+
f.StringVar(&p.metasploitConf.URL, "msfdb-url", "",
139+
"http://metasploit.com:1327 or DB connection string")
140+
130141
f.StringVar(&c.Conf.TrivyCacheDBDir, "trivy-cachedb-dir",
131142
utils.DefaultCacheDir(), "/path/to/dir")
132143
}
@@ -148,6 +159,7 @@ func (p *TuiCmd) Execute(_ context.Context, f *flag.FlagSet, _ ...interface{}) s
148159
c.Conf.OvalDict.Overwrite(p.ovalDict)
149160
c.Conf.Gost.Overwrite(p.gostConf)
150161
c.Conf.Exploit.Overwrite(p.exploitConf)
162+
c.Conf.Metasploit.Overwrite(p.metasploitConf)
151163

152164
var dir string
153165
var err error
@@ -213,12 +225,22 @@ func (p *TuiCmd) Execute(_ context.Context, f *flag.FlagSet, _ ...interface{}) s
213225
return subcommands.ExitFailure
214226
}
215227
}
228+
229+
if c.Conf.Metasploit.URL != "" {
230+
err := msf.CheckHTTPHealth()
231+
if err != nil {
232+
util.Log.Errorf("metasploit HTTP server is not running. err: %+v", err)
233+
util.Log.Errorf("Run go-msfdb as server mode before reporting")
234+
return subcommands.ExitFailure
235+
}
236+
}
216237
dbclient, locked, err := report.NewDBClient(report.DBClientConf{
217-
CveDictCnf: c.Conf.CveDict,
218-
OvalDictCnf: c.Conf.OvalDict,
219-
GostCnf: c.Conf.Gost,
220-
ExploitCnf: c.Conf.Exploit,
221-
DebugSQL: c.Conf.DebugSQL,
238+
CveDictCnf: c.Conf.CveDict,
239+
OvalDictCnf: c.Conf.OvalDict,
240+
GostCnf: c.Conf.Gost,
241+
ExploitCnf: c.Conf.Exploit,
242+
MetasploitCnf: c.Conf.Metasploit,
243+
DebugSQL: c.Conf.DebugSQL,
222244
})
223245
if locked {
224246
util.Log.Errorf("SQLite3 is locked. Close other DB connections and try again: %+v", err)

‎config/config.go

+67-4
Original file line numberDiff line numberDiff line change
@@ -114,10 +114,11 @@ type Config struct {
114114
UUID bool `json:"uuid,omitempty"`
115115
DetectIPS bool `json:"detectIps,omitempty"`
116116

117-
CveDict GoCveDictConf `json:"cveDict,omitempty"`
118-
OvalDict GovalDictConf `json:"ovalDict,omitempty"`
119-
Gost GostConf `json:"gost,omitempty"`
120-
Exploit ExploitConf `json:"exploit,omitempty"`
117+
CveDict GoCveDictConf `json:"cveDict,omitempty"`
118+
OvalDict GovalDictConf `json:"ovalDict,omitempty"`
119+
Gost GostConf `json:"gost,omitempty"`
120+
Exploit ExploitConf `json:"exploit,omitempty"`
121+
Metasploit MetasploitConf `json:"metasploit,omitempty"`
121122

122123
Slack SlackConf `json:"-"`
123124
EMail SMTPConf `json:"-"`
@@ -245,6 +246,10 @@ func (c Config) ValidateOnReportDB() bool {
245246
errs = append(errs, err)
246247
}
247248

249+
if err := validateDB("msfdb", c.Metasploit.Type, c.Metasploit.SQLite3Path, c.Metasploit.URL); err != nil {
250+
errs = append(errs, err)
251+
}
252+
248253
for _, err := range errs {
249254
log.Error(err)
250255
}
@@ -1000,6 +1005,64 @@ func (cnf *ExploitConf) IsFetchViaHTTP() bool {
10001005
return Conf.Exploit.Type == "http"
10011006
}
10021007

1008+
// MetasploitConf is metasploit config
1009+
type MetasploitConf struct {
1010+
// DB type for metasploit dictionary (sqlite3, mysql, postgres or redis)
1011+
Type string
1012+
1013+
// http://metasploit-dictionary.com:1324 or DB connection string
1014+
URL string `json:"-"`
1015+
1016+
// /path/to/metasploit.sqlite3
1017+
SQLite3Path string `json:"-"`
1018+
}
1019+
1020+
func (cnf *MetasploitConf) setDefault() {
1021+
if cnf.Type == "" {
1022+
cnf.Type = "sqlite3"
1023+
}
1024+
if cnf.URL == "" && cnf.SQLite3Path == "" {
1025+
wd, _ := os.Getwd()
1026+
cnf.SQLite3Path = filepath.Join(wd, "go-msfdb.sqlite3")
1027+
}
1028+
}
1029+
1030+
const metasploitDBType = "METASPLOITDB_TYPE"
1031+
const metasploitDBURL = "METASPLOITDB_URL"
1032+
const metasploitDBPATH = "METASPLOITDB_SQLITE3_PATH"
1033+
1034+
// Overwrite set options with the following priority.
1035+
// 1. Command line option
1036+
// 2. Environment variable
1037+
// 3. config.toml
1038+
func (cnf *MetasploitConf) Overwrite(cmdOpt MetasploitConf) {
1039+
if os.Getenv(metasploitDBType) != "" {
1040+
cnf.Type = os.Getenv(metasploitDBType)
1041+
}
1042+
if os.Getenv(metasploitDBURL) != "" {
1043+
cnf.URL = os.Getenv(metasploitDBURL)
1044+
}
1045+
if os.Getenv(metasploitDBPATH) != "" {
1046+
cnf.SQLite3Path = os.Getenv(metasploitDBPATH)
1047+
}
1048+
1049+
if cmdOpt.Type != "" {
1050+
cnf.Type = cmdOpt.Type
1051+
}
1052+
if cmdOpt.URL != "" {
1053+
cnf.URL = cmdOpt.URL
1054+
}
1055+
if cmdOpt.SQLite3Path != "" {
1056+
cnf.SQLite3Path = cmdOpt.SQLite3Path
1057+
}
1058+
cnf.setDefault()
1059+
}
1060+
1061+
// IsFetchViaHTTP returns wether fetch via http
1062+
func (cnf *MetasploitConf) IsFetchViaHTTP() bool {
1063+
return Conf.Metasploit.Type == "http"
1064+
}
1065+
10031066
// AWS is aws config
10041067
type AWS struct {
10051068
// AWS profile to use

‎config/tomlloader.go

+1
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ func (c TOMLLoader) Load(pathToToml, keyPass string) error {
3535
Conf.OvalDict = conf.OvalDict
3636
Conf.Gost = conf.Gost
3737
Conf.Exploit = conf.Exploit
38+
Conf.Metasploit = conf.Metasploit
3839

3940
d := conf.Default
4041
Conf.Default = d

‎go.mod

+3-1
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,10 @@ require (
4646
github.com/rifflock/lfshook v0.0.0-20180920164130-b9218ef580f5
4747
github.com/sirupsen/logrus v1.6.0
4848
github.com/spf13/afero v1.3.0
49-
github.com/spf13/cobra v0.0.5
49+
github.com/spf13/cobra v1.0.0
50+
github.com/takuzoo3868/go-msfdb v0.1.0
5051
golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9
52+
golang.org/x/lint v0.0.0-20200302205851-738671d3881b // indirect
5153
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
5254
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543
5355
k8s.io/utils v0.0.0-20200619165400-6e3d28b6ed19
There was a problem loading the remainder of the diff.

0 commit comments

Comments
 (0)
Failed to load comments.