0x03-2 加载第三方软件 openvas

安装并启动openvas

apt-get install openvas

# 设置openvas，下载最新的规则，需要很长时间
openvas-setup

# 创建账号
root@kali:~# openvasmd --create-user=adminroot --role=Admin
User created with password 'f99fe72f-26cb-40e6-9b58-4f83fa0f41ae'.

# 启动openvas服务
openvas-start

msf加载并使用openvas

# 加载openvas
msf > load openvas 
[*] Welcome to OpenVAS integration by kost and averagesecurityguy.
[*] 
[*] OpenVAS integration requires a database connection. Once the 
[*] database is ready, connect to the OpenVAS server using openvas_connect.
[*] For additional commands use openvas_help.
[*] 
[*] Successfully loaded plugin: OpenVAS

# 查看帮助
msf > openvas_help 
[*] openvas_help                  Display this help
[*] openvas_debug                 Enable/Disable debugging
[*] openvas_version               Display the version of the OpenVAS server
[*] 
[*] CONNECTION
[*] ==========
[*] openvas_connect               Connects to OpenVAS
[*] openvas_disconnect            Disconnects from OpenVAS
[*] 
[*] TARGETS
[*] =======
[*] openvas_target_create         Create target
[*] openvas_target_delete         Deletes target specified by ID
[*] openvas_target_list           Lists targets
[*] 
[*] TASKS
[*] =====
[*] openvas_task_create           Create task
[*] openvas_task_delete           Delete a task and all associated reports
[*] openvas_task_list             Lists tasks
[*] openvas_task_start            Starts task specified by ID
[*] openvas_task_stop             Stops task specified by ID
[*] openvas_task_pause            Pauses task specified by ID
[*] openvas_task_resume           Resumes task specified by ID
[*] openvas_task_resume_or_start  Resumes or starts task specified by ID
[*] 
[*] CONFIGS
[*] =======
[*] openvas_config_list           Lists scan configurations
[*] 
[*] FORMATS
[*] =======
[*] openvas_format_list           Lists available report formats
[*] 
[*] REPORTS
[*] =======
[*] openvas_report_list           Lists available reports
[*] openvas_report_delete         Delete a report specified by ID
[*] openvas_report_import         Imports an OpenVAS report specified by ID
[*] openvas_report_download       Downloads an OpenVAS report specified by ID

# 连接openvas
msf > openvas_connect adminroot f99fe72f-26cb-40e6-9b58-4f83fa0f41ae 127.0.0.1 9390
[*] Connecting to OpenVAS instance at 127.0.0.1:9390 with username adminroot...
/usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201: warning: Object#timeout is deprecated, use Timeout.timeout instead.
[+] OpenVAS connection successful

# 创建一个目标
openvas_target_create  "给目标取一个名字"  目标IP  目标的简单描述
msf > openvas_target_create "winXP" 192.168.10.122 "windows targe"
/usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201: warning: Object#timeout is deprecated, use Timeout.timeout instead.
[*] 4ee16ae0-0350-4597-98e2-de46ccc7ca0b
/usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201: warning: Object#timeout is deprecated, use Timeout.timeout instead.
[+] OpenVAS list of targets

ID                                    Name   Hosts           Max Hosts  In Use  Comment
--                                    ----   -----           ---------  ------  -------
4ee16ae0-0350-4597-98e2-de46ccc7ca0b  winXP  192.168.10.122  1          0       windows targe


# 查看扫描配置项
msf > openvas_config_list 
/usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201: warning: Object#timeout is deprecated, use Timeout.timeout instead.
[+] OpenVAS list of configs

ID                                    Name
--                                    ----
085569ce-73ed-11df-83c3-002264764cea  empty
2d3f051c-55ba-11e3-bf43-406186ea4fc5  Host Discovery
698f691e-7489-11df-9d8c-002264764cea  Full and fast ultimate
708f25c4-7489-11df-8094-002264764cea  Full and very deep
74db13d6-7489-11df-91b9-002264764cea  Full and very deep ultimate
8715c877-47a0-438d-98a3-27c7a6ab2196  Discovery
bbca7412-a950-11e3-9109-406186ea4fc5  System Discovery
daba56c8-73ec-11df-a475-002264764cea  Full and fast

# 创建一个任务
openvas_task_create "任务名称" "描述" 配置项ID  目标ID
msf > openvas_task_create "task_of_winXP" "xp_comment" daba56c8-73ec-11df-a475-002264764cea 4ee16ae0-0350-4597-98e2-de46ccc7ca0b
/usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201: warning: Object#timeout is deprecated, use Timeout.timeout instead.
[*] 5fd5fc77-e7f2-4031-8061-559b4eb772cc
/usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201: warning: Object#timeout is deprecated, use Timeout.timeout instead.
[+] OpenVAS list of tasks

ID                                    Name           Comment     Status  Progress
--                                    ----           -------     ------  --------
5fd5fc77-e7f2-4031-8061-559b4eb772cc  task_of_winXP  xp_comment  New     -1

# 开始任务
openvas_task_start 任务ID
msf > openvas_task_start 5fd5fc77-e7f2-4031-8061-559b4eb772cc
/usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201: warning: Object#timeout is deprecated, use Timeout.timeout instead.
[*] AdminUTCnist3e7be1de-bcc3-47f9-8753-30901914d68f

# 查看任务
msf > openvas_task_list 
/usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201: warning: Object#timeout is deprecated, use Timeout.timeout instead.
[+] OpenVAS list of tasks

ID                                    Name     Comment  Status   Progress
--                                    ----     -------  ------   --------
9f53f3c2-7f4b-46fb-9fe6-c5273f7183d4  task_xp  dis      Running  1

# 查看openvas报告类型
msf > openvas_format_list 
[+] OpenVAS list of report formats

ID                                    Name           Extension  Summary
--                                    ----           ---------  -------
5057e5cc-b825-11e4-9d0e-28d24461215b  Anonymous XML  xml        Anonymous version of the raw XML report
50c9950a-f326-11e4-800c-28d24461215b  Verinice ITG   vna        Greenbone Verinice ITG Report, v1.0.1.
5ceff8ba-1f62-11e1-ab9f-406186ea4fc5  CPE            csv        Common Product Enumeration CSV table.
6c248850-1f62-11e1-b082-406186ea4fc5  HTML           html       Single page HTML report.
77bd6c4a-1f62-11e1-abf0-406186ea4fc5  ITG            csv        German "IT-Grundschutz-Kataloge" report.
9087b18c-626c-11e3-8892-406186ea4fc5  CSV Hosts      csv        CSV host summary.
910200ca-dc05-11e1-954f-406186ea4fc5  ARF            xml        Asset Reporting Format v1.0.0.
9ca6fe72-1f62-11e1-9e7c-406186ea4fc5  NBE            nbe        Legacy OpenVAS report.
9e5e5deb-879e-4ecc-8be6-a71cd0875cdd  Topology SVG   svg        Network topology SVG image.
a3810a62-1f62-11e1-9219-406186ea4fc5  TXT            txt        Plain text report.
a684c02c-b531-11e1-bdc2-406186ea4fc5  LaTeX          tex        LaTeX source file.
a994b278-1f62-11e1-96ac-406186ea4fc5  XML            xml        Raw XML report.
c15ad349-bd8d-457a-880a-c7056532ee15  Verinice ISM   vna        Greenbone Verinice ISM Report, v3.0.0.
c1645568-627a-11e3-a660-406186ea4fc5  CSV Results    csv        CSV result list.
c402cc3e-b531-11e1-9163-406186ea4fc5  PDF            pdf        Portable Document Format report.

# 查看任务结束之后的报告
msf > openvas_report_list 
[+] OpenVAS list of reports

ID                                    Task Name  Start Time            Stop Time
--                                    ---------  ----------            ---------
a6f037de-489e-4e9a-b5de-eafd8b723635  task_xp    2018-12-06T07:38:09Z  2018-12-06T08:11:22Z

# 导入报告
openvas_report_import 报告ID 报告类型ID
msf > openvas_report_import a6f037de-489e-4e9a-b5de-eafd8b723635 9ca6fe72-1f62-11e1-9e7c-406186ea4fc5
[*] Importing report to database.

# 查看结果,之后就是根据CVE编码来选择合适的攻击模块了
msf > vulns 
[*] Time: 2018-12-06 08:21:23 UTC Vuln: host=192.168.10.122 name=ICMP Timestamp Detection refs=CVE-1999-0524 
[*] Time: 2018-12-06 08:21:23 UTC Vuln: host=192.168.10.122 name=Linux Kernel IGMP Remote Denial Of Service Vulnerability refs=CVE-2012-0207,BID-51343 
[*] Time: 2018-12-06 08:21:23 UTC Vuln: host=192.168.10.122 name=Microsoft IIS FTP Server 'ls' Command DOS Vulnerability refs=CVE-2009-2521,BID-36273 
[*] Time: 2018-12-06 08:21:23 UTC Vuln: host=192.168.10.122 name=Microsoft Windows SMB Server Multiple Vulnerabilities-Remote (4013389) refs=CVE-2017-0143,CVE-2017-0144,CVE-2017-0145,CVE-2017-0146,CVE-2017-0147,CVE-2017-0148,BID-96703,BID-96704,BID-96705,BID-96707,BID-96709,BID-96706 
[*] Time: 2018-12-06 08:21:24 UTC Vuln: host=192.168.10.122 name=SSL/TLS: Deprecated SSLv2 and SSLv3 Protocol Detection refs=CVE-2016-0800,CVE-2014-3566 
[*] Time: 2018-12-06 08:21:24 UTC Vuln: host=192.168.10.122 name=SSL/TLS: Report Vulnerable Cipher Suites for HTTPS refs=CVE-2016-2183,CVE-2016-6329 
[*] Time: 2018-12-06 08:21:24 UTC Vuln: host=192.168.10.122 name=SSL/TLS: Report Weak Cipher Suites refs=CVE-2013-2566,CVE-2015-2808,CVE-2015-4000 
[*] Time: 2018-12-06 08:21:24 UTC Vuln: host=192.168.10.122 name=SSL/TLS: RSA Temporary Key Handling 'RSA_EXPORT' Downgrade Issue (FREAK) refs=CVE-2015-0204,BID-71936 
[*] Time: 2018-12-06 08:21:24 UTC Vuln: host=192.168.10.122 name=SSL/TLS: SSLv3 Protocol CBC Cipher Suites Information Disclosure Vulnerability (POODLE) refs=BID-70574 
[*] Time: 2018-12-06 08:21:25 UTC Vuln: host=192.168.10.122 name=Vulnerabilities in SMB Could Allow Remote Code Execution (958687) - Remote refs=CVE-2008-4114,CVE-2008-4834,CVE-2008-4835,BID-31179