1. Get a raw list of exploits: db_autopwn -T -R [min rank] [-p|-x]
2. Filter list by OS information
3. Sort list by rank
4. Use bind listeners where possible, if I can connect to throw the exploit, I
can connect to get my shell/meterpreter session
5. Execute by firing one or two off every 0.5 seconds or so (show a progress
bar)
Advantages:
- Avoids unnecessary exploits (db_autopwn ignores OS information). Armitage is
pretty smart about including multi/* exploits in its acceptable pool, so no
valid exploit option will be missed.
- Sorting will make sure a service is hit with the better exploit before a
weaker one can hit it.
- Use of a progress dialog will make it possible for users to cancel the
operation too.
Question: will ms08_067 fire off before other smb exploits in this scheme?
Original issue reported on code.google.com by rsmu...@gmail.com on 21 Dec 2010 at 11:23
Original issue reported on code.google.com by
rsmu...@gmail.com
on 21 Dec 2010 at 11:23