Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# nessus_xmlrpc_ping.rb
3
##
4

5
##
6
# This module requires Metasploit: https://metasploit.com/download
7
# Current source: https://github.com/rapid7/metasploit-framework
8
##
9

10
class MetasploitModule < Msf::Auxiliary
11
  include Msf::Exploit::Remote::HttpClient
12
  include Msf::Auxiliary::Report
13
  include Msf::Auxiliary::Scanner
14

15
  def initialize
16
    super(
17
      'Name'           => 'Nessus XMLRPC Interface Ping Utility',
18
      'Description'    => %q{
19
        This module simply attempts to find and check
20
        for Nessus XMLRPC interface.'
21
      },
22
      'Author'         => [ 'Vlatko Kosturjak <kost[at]linux.hr>' ],
23
      'License'        => MSF_LICENSE,
24
      'DefaultOptions' => { 'SSL' => true }
25
    )
26

27
    register_options(
28
      [
29
        Opt::RPORT(8834),
30
        OptInt.new('THREADS', [true, "The number of concurrent threads", 25]),
31
        OptString.new('URI', [true, "URI for Nessus XMLRPC. Default is /", "/"])
32
      ])
33
  end
34

35
  def run_host(ip)
36
    begin
37
      res = send_request_cgi({
38
        'uri'     => datastore['URI'],
39
        'method'  => 'GET'
40
        }, 25)
41
      http_fingerprint({ :response => res })
42
    rescue ::Rex::ConnectionError => e
43
      vprint_error("#{datastore['URI']} - #{e.to_s}")
44
      return
45
    end
46

47
    if not res
48
      vprint_error("#{datastore['URI']} - No response")
49
      return
50
    end
51
    if not (res.code == 200 or res.code ==302)
52
      vprint_error("HTTP Response was not 200/302")
53
      return
54
    end
55
    if res.headers['Server'] =~ /NessusWWW/
56
      print_good("SUCCESS. '#{ip}' : '#{datastore['RPORT']}'")
57
      report_service(
58
        :host => ip,
59
        :port => datastore['RPORT'],
60
        :name => "nessus-xmlrpc",
61
        :info => 'Nessus XMLRPC',
62
        :state => 'open'
63
      )
64
    else
65
      vprint_error("Wrong HTTP Server header: #{res.headers['Server'] || ''}")
66
    end
67

68
  end
69
end
70

71