search

rapid7 / metasploit-framework

Metasploit Framework
https://www.metasploit.com/
Other
34.15k stars 13.97k forks source link

Feature request/enhancement (drop show command from 'show options') for faster typing. #6550

Closed nanotechz9l closed 8 years ago

nanotechz9l commented 8 years ago

I propose removing the 'show' command from msfconsole.

Instead of : 'show options' It should accept simply 'options'

Removing show eliminates an entire word and makes typing faster and more fluid. This can already easily be done via the alias command but I'm proposing we make it standard.

PoC: (Existing method)

msf exploit(ms08_067_netapi) > show options (typed in **4 seconds** with the help of tab complete)

Module options (exploit/windows/smb/ms08_067_netapi):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST    192.168.33.230   yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)

Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (accepted: seh, thread, process, none)
   LHOST                      yes       The listen address
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting

Poc: (Proposed method)

msf exploit(ms08_067_netapi) > options (typed in **1 second** with the help of tab complete)) 

Module options (exploit/windows/smb/ms08_067_netapi):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST    192.168.33.230   yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)

Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (accepted: seh, thread, process, none)
   LHOST                      yes       The listen address
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Automatic Target
jhart-r7 commented 8 years ago

This was done in https://github.com/rapid7/metasploit-framework/pull/6173:

$   ./msfconsole -qx "use exploit/windows/smb/ms08_067_netapi; options; info; advanced; quit;"        

Module options (exploit/windows/smb/ms08_067_netapi):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST                     yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)

Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting

       Name: MS08-067 Microsoft Server Service Relative Path Stack Corruption
     Module: exploit/windows/smb/ms08_067_netapi
   Platform: Windows
 Privileged: Yes
    License: Metasploit Framework License (BSD)
       Rank: Great
  Disclosed: 2008-10-28

Provided by:
  hdm <x@hdm.io>
  Brett Moore <brett.moore@insomniasec.com>
  frank2 <frank2@dc949.org>
  jduck <jduck@metasploit.com>

Available targets:
  Id  Name
  --  ----
  0   Automatic Targeting
  1   Windows 2000 Universal
  2   Windows XP SP0/SP1 Universal
  3   Windows 2003 SP0 Universal
  4   Windows XP SP2 English (AlwaysOn NX)
  5   Windows XP SP2 English (NX)
  6   Windows XP SP3 English (AlwaysOn NX)
  7   Windows XP SP3 English (NX)
  8   Windows XP SP2 Arabic (NX)
  9   Windows XP SP2 Chinese - Traditional / Taiwan (NX)
  10  Windows XP SP2 Chinese - Simplified (NX)
  11  Windows XP SP2 Chinese - Traditional (NX)
  12  Windows XP SP2 Czech (NX)
  13  Windows XP SP2 Danish (NX)
  14  Windows XP SP2 German (NX)
  15  Windows XP SP2 Greek (NX)
  16  Windows XP SP2 Spanish (NX)
  17  Windows XP SP2 Finnish (NX)
  18  Windows XP SP2 French (NX)
  19  Windows XP SP2 Hebrew (NX)
  20  Windows XP SP2 Hungarian (NX)
  21  Windows XP SP2 Italian (NX)
  22  Windows XP SP2 Japanese (NX)
  23  Windows XP SP2 Korean (NX)
  24  Windows XP SP2 Dutch (NX)
  25  Windows XP SP2 Norwegian (NX)
  26  Windows XP SP2 Polish (NX)
  27  Windows XP SP2 Portuguese - Brazilian (NX)
  28  Windows XP SP2 Portuguese (NX)
  29  Windows XP SP2 Russian (NX)
  30  Windows XP SP2 Swedish (NX)
  31  Windows XP SP2 Turkish (NX)
  32  Windows XP SP3 Arabic (NX)
  33  Windows XP SP3 Chinese - Traditional / Taiwan (NX)
  34  Windows XP SP3 Chinese - Simplified (NX)
  35  Windows XP SP3 Chinese - Traditional (NX)
  36  Windows XP SP3 Czech (NX)
  37  Windows XP SP3 Danish (NX)
  38  Windows XP SP3 German (NX)
  39  Windows XP SP3 Greek (NX)
  40  Windows XP SP3 Spanish (NX)
  41  Windows XP SP3 Finnish (NX)
  42  Windows XP SP3 French (NX)
  43  Windows XP SP3 Hebrew (NX)
  44  Windows XP SP3 Hungarian (NX)
  45  Windows XP SP3 Italian (NX)
  46  Windows XP SP3 Japanese (NX)
  47  Windows XP SP3 Korean (NX)
  48  Windows XP SP3 Dutch (NX)
  49  Windows XP SP3 Norwegian (NX)
  50  Windows XP SP3 Polish (NX)
  51  Windows XP SP3 Portuguese - Brazilian (NX)
  52  Windows XP SP3 Portuguese (NX)
  53  Windows XP SP3 Russian (NX)
  54  Windows XP SP3 Swedish (NX)
  55  Windows XP SP3 Turkish (NX)
  56  Windows 2003 SP1 English (NO NX)
  57  Windows 2003 SP1 English (NX)
  58  Windows 2003 SP1 Japanese (NO NX)
  59  Windows 2003 SP1 Spanish (NO NX)
  60  Windows 2003 SP1 Spanish (NX)
  61  Windows 2003 SP1 French (NO NX)
  62  Windows 2003 SP1 French (NX)
  63  Windows 2003 SP2 English (NO NX)
  64  Windows 2003 SP2 English (NX)
  65  Windows 2003 SP2 German (NO NX)
  66  Windows 2003 SP2 German (NX)
  67  Windows 2003 SP2 Portuguese - Brazilian (NX)
  68  Windows 2003 SP2 Spanish (NO NX)
  69  Windows 2003 SP2 Spanish (NX)
  70  Windows 2003 SP2 Japanese (NO NX)
  71  Windows 2003 SP2 French (NO NX)
  72  Windows 2003 SP2 French (NX)

Basic options:
  Name     Current Setting  Required  Description
  ----     ---------------  --------  -----------
  RHOST                     yes       The target address
  RPORT    445              yes       Set the SMB service port
  SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)

Payload information:
  Space: 408
  Avoid: 8 characters

Description:
  This module exploits a parsing flaw in the path canonicalization 
  code of NetAPI32.dll through the Server Service. This module is 
  capable of bypassing NX on some operating systems and service packs. 
  The correct target must be used to prevent the Server Service (along 
  with a dozen others in the same process) from crashing. Windows XP 
  targets seem to handle multiple successful exploitation events, but 
  2003 targets will often crash or hang on subsequent attempts. This 
  is just the first version of this module, full support for NX bypass 
  on 2003, along with other platforms, is still in development.

References:
  http://cvedetails.com/cve/2008-4250/
  http://www.osvdb.org/49243
  http://technet.microsoft.com/en-us/security/bulletin/MS08-067
  http://www.rapid7.com/vulndb/lookup/dcerpc-ms-netapi-netpathcanonicalize-dos

Module advanced options (exploit/windows/smb/ms08_067_netapi):

   Name           : CHOST
   Current Setting: 
   Description    : The local client address

   Name           : CPORT
   Current Setting: 
   Description    : The local client port

   Name           : ConnectTimeout
   Current Setting: 10
   Description    : Maximum number of seconds to establish a TCP connection

   Name           : ContextInformationFile
   Current Setting: 
   Description    : The information file that contains context information

   Name           : DCERPC::ReadTimeout
   Current Setting: 10
   Description    : The number of seconds to wait for DCERPC responses

   Name           : DisablePayloadHandler
   Current Setting: false
   Description    : Disable the handler code for the selected payload

   Name           : EnableContextEncoding
   Current Setting: false
   Description    : Use transient context when encoding payloads

   Name           : NTLM::SendLM
   Current Setting: true
   Description    : Always send the LANMAN response (except when NTLMv2_session is 
      specified)

   Name           : NTLM::SendNTLM
   Current Setting: true
   Description    : Activate the 'Negotiate NTLM key' flag, indicating the use of 
      NTLM responses

   Name           : NTLM::SendSPN
   Current Setting: true
   Description    : Send an avp of type SPN in the ntlmv2 client blob, this allows 
      authentication on Windows 7+/Server 2008 R2+ when SPN is 
      required

   Name           : NTLM::UseLMKey
   Current Setting: false
   Description    : Activate the 'Negotiate Lan Manager Key' flag, using the LM key 
      when the LM response is sent

   Name           : NTLM::UseNTLM2_session
   Current Setting: true
   Description    : Activate the 'Negotiate NTLM2 key' flag, forcing the use of a 
      NTLMv2_session

   Name           : NTLM::UseNTLMv2
   Current Setting: true
   Description    : Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key 
      is true

   Name           : Proxies
   Current Setting: 
   Description    : A proxy chain of format type:host:port[,type:host:port][...]

   Name           : SMB::ChunkSize
   Current Setting: 500
   Description    : The chunk size for SMB segments, bigger values will increase 
      speed but break NT 4.0 and SMB signing

   Name           : SMB::Native_LM
   Current Setting: Windows 2000 5.0
   Description    : The Native LM to send during authentication

   Name           : SMB::Native_OS
   Current Setting: Windows 2000 2195
   Description    : The Native OS to send during authentication

   Name           : SMB::VerifySignature
   Current Setting: false
   Description    : Enforces client-side verification of server response signatures

   Name           : SMBDirect
   Current Setting: true
   Description    : The target port is a raw SMB service (not NetBIOS)

   Name           : SMBDomain
   Current Setting: .
   Description    : The Windows domain to use for authentication

   Name           : SMBName
   Current Setting: *SMBSERVER
   Description    : The NetBIOS hostname (required for port 139 connections)

   Name           : SMBPass
   Current Setting: 
   Description    : The password for the specified username

   Name           : SMBUser
   Current Setting: 
   Description    : The username to authenticate as

   Name           : SSL
   Current Setting: false
   Description    : Negotiate SSL/TLS for outgoing connections

   Name           : SSLCipher
   Current Setting: 
   Description    : String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"

   Name           : SSLVerifyMode
   Current Setting: PEER
   Description    : SSL verification method (Accepted: CLIENT_ONCE, 
      FAIL_IF_NO_PEER_CERT, NONE, PEER)

   Name           : SSLVersion
   Current Setting: TLS1
   Description    : Specify the version of SSL/TLS to be used (TLS and SSL23 are 
      auto-negotiate) (Accepted: SSL2, SSL3, SSL23, TLS, TLS1, TLS1.1, 
      TLS1.2)

   Name           : VERBOSE
   Current Setting: false
   Description    : Enable detailed status messages

   Name           : WORKSPACE
   Current Setting: 
   Description    : Specify the workspace for this module

   Name           : WfsDelay
   Current Setting: 0
   Description    : Additional delay when waiting for a session
nanotechz9l commented 8 years ago

Thats an awesome update! Thanks Jon!

nanotechz9l commented 8 years ago

Hi Jon,

Can you also provide an update to the below feature request by chance? I submitted a few months ago and I think it's a really great idea to implement if not already.

https://github.com/rapid7/metasploit-framework/issues/4336