metasploit-framework/plugins/openvas.rb

#!/usr/bin/env ruby
#
# This plugin provides integration with OpenVAS. Written by kost.
# Distributed under MIT license: 
# http://www.opensource.org/licenses/mit-license.php
#
# Typical usage:
# load openvas
# db_create
# openvas_connect test test localhost 9390 ok
# openvas_scan localhost

require 'openvas/openvas-omp'

module Msf
class Plugin::OpenVAS < Msf::Plugin
	class OpenVASCommandDispatcher
		include Msf::Ui::Console::CommandDispatcher

		def name
			"OpenVAS"
		end

		def commands
			{
				'openvas_help'           => "Displays help",
				'openvas_connect'        => "Connect to a OpenVAS manager using OMP ( user:pass@host[:port] )",
				'openvas_task_list'      => "Display list of tasks",
				'openvas_task_create'      => "Creates task (name, comment, target, config)",
				'openvas_task_start'    => "Start task by ID",
				'openvas_task_stop'    => "Stop task by ID",
				'openvas_task_pause'    => "Pause task by ID",
				'openvas_task_resume'    => "Resume task by ID",
				'openvas_task_resume_or_start'    => "Resume task or start task by ID",
				'openvas_task_status'    => "Get status of task ID",
				'openvas_task_delete'    => "Delete task by ID",

				'openvas_target_create'    => "Create target (name, hosts, comment)",
				'openvas_target_list'    => "Display list of targets",
				'openvas_target_delete'  => "Delete target by ID",

				'openvas_config_list'    => "Quickly display list of configs",
				'openvas_report_import'	 => "Import report specified by ID to framework",
				'openvas_report_save'	=> "Save report specified by ID and format to file",

				'openvas_scan'           => "Launch an automatic OpenVAS scan against a specific IP range and import the results",

				'openvas_debug'          => "Sets debug level",
				'openvas_disconnect'     => "Disconnect from OpenVAS manager",

			}
		end

		def cmd_openvas_help (*args)
			usage="
openvas_help			Display this help

CONNECTION
==========
openvas_connect			Connects to OpenVAS
openvas_disconnect		Disconnects from OpenVAS

TARGETS
=======
openvas_target_list		Lists targets
openvas_target_create		Create target
openvas_target_delete		Deletes target specified by ID

TASKS
=====
openvas_task_list		Lists tasks
openvas_task_create		Create task 
openvas_task_start		Starts task specified by ID
openvas_task_stop		Stops task specified by ID
openvas_task_pause		Pauses task specified by ID
openvas_task_resume		Resumes task specified by ID
openvas_task_resume_or_start	Resumes or starts task specified by ID

CONFIGS
=======
openvas_config_list		Lists configs

REPORTS
=======
openvas_report_import		Imports OpenVAS report in framework spec. by ID
openvas_report_save		Saves OpenVAS report specified by ID and format

AUTO
====
openvas_scan			Launch an automatic OpenVAS scan against a specific IP range and import the results automatically with optional autopwn
"
			print_status(usage)
		end

		def openvas_verify
			if ! @ov
				print_error("No active OpenVAS instance has been configured, please use 'openvas_connect'")
				return false
			end

			if ! (framework.db and framework.db.usable)
				print_error("No database has been configured, please use db_create/db_connect first")
				return false
			end

			true
		end

		def cmd_openvas_debug(*args)
			usagecmd="openvas_debug <level>
Example: openvas_debug 99"
			return if not openvas_verify
			if(args.length == 0 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				level=args[0]
				@ov.debug(level)
				print_good("Command completed successfuly: "+level)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_task_start(*args)
			usagecmd="openvas_task_start <id>
Example: openvas_task_start 9fd90790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if(args.length == 0 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=args[0]
				@ov.task_start(id)
				print_good("Command completed successfuly: "+id)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_task_create(*args)
			usagecmd="openvas_task_create <name> <comment> <config_id> <target_id>
Example: openvas_task_create newtask MyNewTask abc12345-a234-46a1-c01c-123456789012 9abc0790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if(args.length != 4 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=@ov.task_create({"name"=>args[0],"comment"=>arg[1],"config"=>args[2],"target"=>args[3]})
				print_good("Command completed successfuly: "+id)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_task_stop(*args)
			usagecmd="openvas_task_stop <id>
Example: openvas_task_stop 9fd90790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if(args.length == 0 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=args[0]
				@ov.task_stop(id)
				print_good("Command completed successfuly: "+id)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_task_pause(*args)
			usagecmd="openvas_task_pause <id>
Example: openvas_task_pause 9fd90790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if(args.length == 0 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=args[0]
				@ov.task_pause(id)
				print_good("Command completed successfuly: "+id)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_task_resume(*args)
			usagecmd="openvas_task_resume <id>
Example: openvas_task_resume 9fd90790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if(args.length == 0 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=args[0]
				@ov.task_resume(id)
				print_good("Command completed successfuly: "+id)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_task_resume_or_start(*args)
			usagecmd="openvas_task_resume_or_start <id>
Example: openvas_task_resume_or_start 9fd90790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if(args.length == 0 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=args[0]
				@ov.task_resume_or_start(id)
				print_good("Command completed successfuly: "+id)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_task_delete(*args)
			usagecmd="openvas_task_delete <id>
Example: openvas_task_delete 9fd90790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if(args.length == 0 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=args[0]
				@ov.task_delete(id)
				print_good("Command completed successfuly: "+id)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_task_status(*args)
			usagecmd="openvas_task_status <id>
Example: openvas_task_status 9fd90790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if (args.length == 0 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=args[0]
				tbl = Rex::Ui::Text::Table.new(
					'Columns' => 
					[ "ID", "Name", "Status", "Progress", "Comment","First Report","Last Report" ]
				)
				@ov.task_get_all("task_id"=>id).each do |task|
					tbl << [ task["id"] , task["name"] , 
						task["status"], 
						task["progress"],
						task["comment"],
						task["firstreport"],
						task["lastreport"] 
					]
				end
				print_good("OpenVAS task status")
				puts "\n"
				puts tbl.to_s + "\n"
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_task_list(*args)
			usagecmd="openvas_task_list [id]
Example: openvas_task_list 
Example: openvas_task_list 9fd90790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if (args[0] == "-h") then
				print_status(usagecmd)
				return
			end
			if not (args.length == 0 or args[0].empty?) then
				id=args[0]
			end
			begin
				tbl = Rex::Ui::Text::Table.new(
					'Columns' => 
					[ "ID", "Name", "Status", "Progress" ]
				)
				p={}
				if id 
					p={"task_id"=>id}
				end
				@ov.task_get_all(p).each do |task|
					tbl << [ task["id"] , task["name"] , 
						task["status"] , task["progress"] ]
				end
				print_good("OpenVAS list of tasks")
				puts "\n"
				puts tbl.to_s + "\n"
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_target_list(*args)
			usagecmd="openvas_target_list [id]
Example: openvas_target_list 
Example: openvas_target_list 9fd90790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if (args[0] == "-h") then
				print_status(usagecmd)
				return
			end
			if not (args.length == 0 or args[0].empty?) then
				id=args[0]
			end
			begin
				tbl = Rex::Ui::Text::Table.new(
					'Columns' => [ "ID","Name","Hosts" ])
				p={}
				if id 
					p={"target_id"=>id}
				end
				@ov.target_get_all(p).each do |target|
					tbl << [target["id"], 
					target["name"], 
					target["hosts"] ]
				end
				print_good("OpenVAS list of targets")
				puts "\n"
				puts tbl.to_s + "\n"
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_target_create(*args)
			usagecmd="openvas_target_create <name> <hosts> <comment>

Example: openvas_target_create mylocalhost 127.0.0.1 MyLocalHostComment"
			return if not openvas_verify
			if(args.length != 3 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=@ov.target_create({"name"=>args[0],"comment"=>arg[2],"hosts"=>args[1]})
				print_good("Command completed successfuly: "+id)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_target_delete(*args)
			usagecmd="openvas_target_delete <id>
Example: openvas_target_delete 9fd90790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if(args.length == 0 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=args[0]
				@ov.target_delete(id)
				print_good("Command completed successfuly: "+id)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_connect(*args)
			usagecmd = "Usage:
       openvas_connect username:password@host[:port] <ssl-confirm>
 -OR- 
       openvas_connect username password host port <ssl-confirm>"			

			if(args.length == 0 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end

			user = pass = host = port = sslv = nil

			case args.length
			when 1,2
				cred,targ = args[0].split('@', 2)
				user,pass = cred.split(':', 2)
				targ ||= '127.0.0.1:9390'
				host,port = targ.split(':', 2)
				port ||= '9390'
				sslv = args[1]
			when 4,5
				user,pass,host,port,sslv = args
			else
				print_status(usagecmd)
				return
			end


			if ! ((user and user.length > 0) and (host and host.length > 0) and (port and port.length > 0 and port.to_i > 0) and (pass and pass.length > 0))
				print_status(usagecmd)
				return
			end

			# taken from NeXpose WARNING
			if(host != "localhost" and host != "127.0.0.1" and sslv != "ok")
				print_error("Warning: SSL connections are not verified in this release, it is possible for an attacker")
				print_error("         with the ability to man-in-the-middle the OpenVAS traffic to capture the OpenVAS")
				print_error("         credentials. If you are running this on a trusted network, please pass in 'ok'")
				print_error("         as an additional parameter to this command.")
				return
			end

			# Wrap this so a duplicate session doesnt prevent a new login
			begin
			cmd_openvas_disconnect
			rescue ::Interrupt
				raise $!
			rescue ::Exception
			end

			begin
				print_status("Connecting to OpenVAS instance at #{host}:#{port} with username #{user}...")
				ov = OpenVASOMP::OpenVASOMP.new("user"=>user,"password"=>pass,"host"=>host,"port"=>port)
			rescue OpenVASOMP::OMPAuthError => e
				print_error("Connection failed: #{e.reason}")
				return
			end

			@ov = ov
		end

		def cmd_openvas_config_list(*args)
			usagecmd="openvas_config_list [id]
Example: openvas_config_list 
Example: openvas_config_list 9fd90790-a79b-49e0-b08e-6912afde72f4"
			return if not openvas_verify
			if (args[0] == "-h") then
				print_status(usagecmd)
				return
			end
			if not (args.length == 0 or args[0].empty?) then
				id=args[0]
			end
			begin
				tbl = Rex::Ui::Text::Table.new(
					'Columns' => 
					[ "ID", "Name", "Comments" ]
				)
				p={}
				if id 
					p={"config_id"=>id}
				end
				@ov.config_get_all(p).each do |config|
					tbl << [ config["id"], config["name"], 
						config["comment"] ]
				end
				print_good("OpenVAS list of configs")
				puts "\n"
				puts tbl.to_s + "\n"
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_report_import(*args)
			usagecmd="openvas_report_import <id> 
Example: openvas_report_import 9fd90790-a79b-49e0-b08e-6912afde72f4
Note: gets NBE report from the OpenVAS and tries to import it into framework
"
			return if not openvas_verify
			if(args.length == 0 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=args[0]
				content=@ov.report_get_byid(id,'NBE')
				framework.db.import({:data => content})
				print_good("Command completed successfuly: "+id)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_report_save(*args)
			usagecmd="openvas_report_save <id> <format> <file>
Example: openvas_report_save 9fd90790-a79b-49e0-b08e-6912afde72f4 PDF /tmp/a.pdf"
			return if not openvas_verify
			if(args.length != 3 or args[0].empty? or args[0] == "-h")
				print_status(usagecmd)
				return
			end
			begin
				id=args[0]
				content=@ov.report_get_byid(id,args[1])
				File.open(args[2], 'w') {|f| f.write(content) }
				print_good("Command completed successfuly: "+id)
			rescue ::Exception
				print_error("Error executing")
			end
		end

		def cmd_openvas_scan(*args)
			opts = Rex::Parser::Arguments.new(
				"-h"   => [ false,  "This help menu"],
				"-t"   => [ true,   "The scan template to use (default:Full and fast )"],
				"-P"   => [ false,  "Leave the scan data on the server when it completes (this counts against the maximum licensed IPs)"],
				"-x"   => [ false,  "Automatically launch all exploits by matching reference after the scan completes (unsafe)"],
				"-X"   => [ false,  "Automatically launch all exploits by matching reference and port after the scan completes (unsafe)"],
				"-d"   => [ false,  "Scan hosts based on the contents of the existing database"],
				"-v"   => [ false,  "Display diagnostic information about the scanning process"],
				"-I"   => [ true,   "Only scan systems with an address within the specified range"],
				"-E"   => [ true,   "Exclude hosts in the specified range from the scan"],
				"-R"   => [ true,   "Specify a minimum exploit rank to use for automated exploitation"]
			)

			opt_template  = "Full and fast"
			opt_verbose   = false
			opt_preserve  = false
			opt_autopwn   = false
			opt_rescandb  = false
			opt_addrinc   = nil
			opt_addrexc   = nil
			opt_scanned   = []
			opt_minrank   = "manual"

			opt_ranges    = []

			opts.parse(args) do |opt, idx, val|
				case opt
				when "-h"
					print_line("Usage: openvas_scan [options] <Target IP Ranges>")
					print_line(opts.usage)
					return
				when "-v"
					opt_verbose = true
				when "-t"
					opt_template = val
				when "-P"
					opt_preserve = true
				when "-X"
					opt_autopwn = "-p -x"
				when "-x"
					opt_autopwn = "-x" unless opt_autopwn
				when "-d"
					opt_rescandb = true
				when '-I'
					opt_addrinc = OptAddressRange.new('TEMPRANGE', [ true, '' ]).normalize(val)
				when '-E'
					opt_addrexc = OptAddressRange.new('TEMPRANGE', [ true, '' ]).normalize(val)
				else
					opt_ranges << val
				end
			end

			return if not openvas_verify

			# Include all database hosts as scan targets if specified
			if(opt_rescandb)
				print_status("Loading scan targets from the active database...") if opt_verbose
				framework.db.hosts.each do |host|
					next if host.state != ::Msf::HostState::Alive
					opt_ranges << host.address
				end
			end

			opt_ranges = opt_ranges.join(',')

			if(opt_ranges.strip.empty?)
				print_line("Usage: openvas_scan [options] <Target IP Ranges>")
				print_line(opts.usage)
				return
			end

			if(opt_verbose)
				print_status("Creating a new scan using config #{opt_template} against #{opt_ranges}")
			end

			range_inp = ::Msf::OptAddressRange.new('TEMPRANGE', [ true, '' ]).normalize(opt_ranges)
			range     = ::Rex::Socket::RangeWalker.new(range_inp)
			include_range = opt_addrinc ? ::Rex::Socket::RangeWalker.new(opt_addrinc) : nil
			exclude_range = opt_addrexc ? ::Rex::Socket::RangeWalker.new(opt_addrexc) : nil

			completed = 0
			total     = range.num_ips
			count     = 0

			print_status("Scanning #{total} addresses with config #{opt_template}")

			while(completed < total)
				count    += 1
				queue     = []

				while(ip = range.next_ip )

					if(exclude_range and exclude_range.include?(ip))
						print_status(" >> Skipping host #{ip} due to exclusion") if opt_verbose
						next
					end

					if(include_range and ! include_range.include?(ip))
						print_status(" >> Skipping host #{ip} due to inclusion filter") if opt_verbose
						next
					end

					opt_scanned << ip
					queue << ip
				end

				break if queue.empty?
				print_status("Scanning #{queue[0]}-#{queue[-1]}...") if opt_verbose

				msfid = Time.now.to_i
				
				ipstr=''
				queue.each do |ip|
					ipstr=ipstr+","+ip
				end	
				# Create a temporary site
				mname="Metasploit-#{msfid}"
				mcomment="Autocreated by the Metasploit Framework"
				mtarget=@ov.target_create({"name"=>mname, "hosts"=>ipstr, "comment"=>mcomment})		
				
				print_status(" >> Created temporary target #{mname} with id #{mtarget}") if opt_verbose

				mconfig=@ov.config_get().index(opt_template)	
				
				if mconfig 
					print_status(" >> Found config #{opt_template} with id #{mconfig}") if opt_verbose
				else
					print_error("Config not found")
					break
				end
	
				# Create temporary task
				mtask = @ov.task_create({"name"=>mname,"comment"=>mcomment, "target"=>mtarget, "config"=>mconfig})
				if mtask 
					print_status(" >> Created task #{mname} with id #{mtask}") if opt_verbose
				else
					print_error("Task could not be created")
					break
				end


				@ov.task_start(mtask)

				print_status(" >> Scan has been launched with ID #{mtask}") if opt_verbose

				rep = true
				begin
				prev = nil
				while(true)
					stat = @ov.task_get_byid(mtask)
					break if stat["status"] == "Done" 
					percent=stat["progress"]

					stat = "Progress: #{percent} %"
					if(stat != prev)
						print_status(" >> #{stat}") if opt_verbose
					end
					prev = stat
					select(nil, nil, nil, 5.0)
				end
				print_status(" >> Scan has been completed with task ID #{mtask}") if opt_verbose
				rescue ::Interrupt
					rep = false
					print_status(" >> Terminating task ID #{mtask} due to console interupt") if opt_verbose
					@ov.task_stop(mtask)
					break
				end

				# Wait for the automatic report generation to complete
				if(rep)
					print_status(" >> Getting report...") if opt_verbose
					stat = @ov.task_get_byid(mtask)

					if stat["status"] != "Done" 
					content=@ov.report_get_byid(stat["lastreport"],'NBE')
					print_status(" >> Importing the report data from OpenVAS...") if opt_verbose
					framework.db.import({:data => content})

				end

				if ! opt_preserve
					print_status(" >> Deleting the temporary task and target...") if opt_verbose
					@ov.task_delete(mtask)
					@ov.target_delete(mtarget)
				end
			end

			print_status("Completed the scan of #{total} addresses")

			if(opt_autopwn)
				print_status("Launching an automated exploitation session")
				driver.run_single("db_autopwn -q -r -e -t #{opt_autopwn} -R #{opt_minrank} -I #{opt_scanned.join(",")}")
			end
		end
		end

		def cmd_openvas_disconnect(*args)
			@ov.logout if @ov
			@ov = nil
		end
	end

	#
	# Plugin initialization
	#

	def initialize(framework, opts)
		super
		add_console_dispatcher(OpenVASCommandDispatcher)
		print "Welcome to OpenVAS integration by kost\n\n"	
		print "Use openvas_help for list of commands you can use.\n"
		print "Note that you should have database ready. After that you should connect with:\n"
		print "openvas_connect (try with -h for help on connecting)\n"
		print_status("OpenVAS integration has been activated")
	end

	def cleanup
		remove_console_dispatcher('OpenVAS')
	end

	def name
		"OpenVAS"
	end

	def desc
		"Integrates with the OpenVAS - open source vulnerability management"
	end
end
end