1
#!/usr/bin/env ruby
2

3
##
4
# This module requires Metasploit: https://metasploit.com/download
5
# Current source: https://github.com/rapid7/metasploit-framework
6
##
7

8
#
9
# This script lists each module with its references
10
#
11

12
msfbase = __FILE__
13
msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) while File.symlink?(msfbase)
14

15
$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib')))
16
require 'msfenv'
17

18
$:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB']
19

20
require 'rex'
21
require 'uri'
22

23
# See lib/msf/core/module/reference.rb
24
# We gsub '#{in_ctx_val}' with the actual value
25
def types
26
  {
27
    'ALL' => '',
28
    'CVE' => 'https://nvd.nist.gov/vuln/detail/CVE-#{in_ctx_val}',
29
    'CWE' => 'http://cwe.mitre.org/data/definitions/#{in_ctx_val}.html',
30
    'BID' => 'http://www.securityfocus.com/bid/#{in_ctx_val}',
31
    'MSB' => 'https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/#{in_ctx_val}',
32
    'EDB' => 'http://www.exploit-db.com/exploits/#{in_ctx_val}',
33
    'US-CERT-VU' => 'http://www.kb.cert.org/vuls/id/#{in_ctx_val}',
34
    'ZDI' => 'http://www.zerodayinitiative.com/advisories/ZDI-#{in_ctx_val}',
35
    'WPVDB' => 'https://wpscan.com/vulnerability/#{in_ctx_val}',
36
    'PACKETSTORM' => 'https://packetstormsecurity.com/files/#{in_ctx_val}',
37
    'GHSA' => 'https://github.com/advisories/#{in_ctx_val}',
38
    'OSV' => 'https://osv.dev/vulnerability/#{in_ctx_val}',
39
    'URL' => '#{in_ctx_val}'
40
  }
41
end
42

43
STATUS_ALIVE = 'Alive'
44
STATUS_DOWN = 'Down'
45
STATUS_REDIRECT = 'Redirect'
46
STATUS_UNSUPPORTED = 'Unsupported'
47

48
sort = 0
49
filter = 'All'
50
filters = ['all', 'exploit', 'payload', 'post', 'nop', 'encoder', 'auxiliary']
51
type = 'ALL'
52
match = nil
53
check = false
54
save = nil
55
is_url_alive_cache = {}
56
http_timeout = 20
57
$verbose = false
58

59
opts = Rex::Parser::Arguments.new(
60
  '-h' => [ false, 'Help menu.' ],
61
  '-c' => [ false, 'Check Reference status'],
62
  '-s' => [ false, 'Sort by Reference instead of Module Type.'],
63
  '-r' => [ false, 'Reverse Sort'],
64
  '-f' => [ true, 'Filter based on Module Type [All,Exploit,Payload,Post,NOP,Encoder,Auxiliary] (Default = ALL).'],
65
  '-t' => [ true, "Type of Reference to sort by #{types.keys}"],
66
  '-x' => [ true, 'String or RegEx to try and match against the Reference Field'],
67
  '-o' => [ true, 'Save the results to a file'],
68
  '--csv' => [ false, 'Save the results file in CSV format'],
69
  '-i' => [ true, 'Set an HTTP timeout'],
70
  '-v' => [ false, 'Verbose']
71
)
72

73
flags = []
74

75
opts.parse(ARGV) do |opt, _idx, val|
76
  case opt
77
  when '-h'
78
    puts "\nMetasploit Script for Displaying Module Reference information."
79
    puts '=========================================================='
80
    puts opts.usage
81
    exit
82
  when '-c'
83
    flags << 'URI Check: Yes'
84
    check = true
85
  when '-s'
86
    flags << 'Order: Sorting by Reference'
87
    sort = 1
88
  when '-r'
89
    flags << 'Order: Reverse Sorting'
90
    sort = 2
91
  when '-f'
92
    unless filters.include?(val.downcase)
93
      puts "Invalid Filter Supplied: #{val}"
94
      puts "Please use one of these: #{filters.map { |f| f.capitalize }.join(', ')}"
95
      exit
96
    end
97
    flags << "Module Filter: #{val}"
98
    filter = val
99
  when '-t'
100
    val = (val || '').upcase
101
    unless types.has_key?(val)
102
      puts "Invalid Type Supplied: #{val}"
103
      puts "Please use one of these: #{types.keys.inspect}"
104
      exit
105
    end
106
    type = val
107
  when '-i'
108
    http_timeout = /^\d+/ === val ? val.to_i : 20
109
  when '-v'
110
    $verbose = true
111
  when '-x'
112
    flags << "Regex: #{val}"
113
    match = Regexp.new(val)
114
  when '-o'
115
    flags << 'Output to file: Yes'
116
    save = val
117
  when '--csv'
118
    flags << 'Output as CSV'
119
    $csv = true
120
  end
121
end
122

123
if $csv && save.nil?
124
  abort('Error: -o flag required when using CSV output')
125
end
126

127
flags << "Type: #{type}"
128

129
puts flags * ' | '
130

131
def get_ipv4_addr(hostname)
132
  Rex::Socket.getaddresses(hostname, false)[0]
133
end
134

135
def vprint_debug(msg = '')
136
  print_debug(msg) if $verbose
137
end
138

139
def print_debug(msg = '')
140
  warn "[*] #{msg}"
141
end
142

143
def is_url_alive(uri, http_timeout, cache)
144
  if cache.key? uri.to_s
145
    print_debug("Cached: #{uri} -> #{cache[uri]}")
146
    return cache[uri.to_s]
147
  end
148
  print_debug("Checking: #{uri}")
149

150
  begin
151
    uri = URI(uri)
152
    rhost = get_ipv4_addr(uri.host)
153
  rescue SocketError, URI::InvalidURIError => e
154
    vprint_debug("#{e.message} in #is_url_alive")
155
    return STATUS_DOWN
156
  end
157

158
  rport = uri.port || 80
159
  path = uri.path.blank? ? '/' : uri.path
160
  vhost = rport == 80 ? uri.host : "#{uri.host}:#{rport}"
161
  if uri.scheme == 'https'
162
    cli = ::Rex::Proto::Http::Client.new(rhost, 443, {}, true)
163
  else
164
    cli = ::Rex::Proto::Http::Client.new(rhost, rport)
165
  end
166

167
  begin
168
    cli.connect(http_timeout)
169
    req = cli.request_raw('uri' => path, 'vhost' => vhost)
170
    res = cli.send_recv(req, http_timeout)
171
  rescue Errno::ECONNRESET, Rex::ConnectionError, Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::UnsupportedProtocol, ::Timeout::Error, Errno::ETIMEDOUT, ::Exception => e
172
    vprint_debug("#{e.message} for #{uri}")
173
    cache[uri.to_s] = STATUS_DOWN
174
    return STATUS_DOWN
175
  ensure
176
    cli.close
177
  end
178

179
  if !res.nil? && res.code.to_s =~ %r{3\d\d}
180
    if res.headers['Location']
181
      vprint_debug("Redirect: #{uri} redirected to #{res.headers['Location']}")
182
    else
183
      print_error("Error: Couldn't find redirect location for #{uri}")
184
    end
185
    cache[uri.to_s] = STATUS_REDIRECT
186
    return STATUS_REDIRECT
187
  elsif res.nil? || res.body =~ %r{<title>.*not found</title>}i || !res.code.to_s =~ %r{2\d\d}
188
    vprint_debug("Down: #{uri} returned a not-found response")
189
    cache[uri.to_s] = STATUS_DOWN
190
    return STATUS_DOWN
191
  end
192

193
  vprint_debug("Good: #{uri}")
194

195
  cache[uri.to_s] = STATUS_ALIVE
196
  STATUS_ALIVE
197
end
198

199
def save_results(path, results)
200
  File.open(path, 'wb') do |f|
201
    f.write(results)
202
  end
203
  puts "Results saved to: #{path}"
204
rescue Exception => e
205
  puts "Failed to save the file: #{e.message}"
206
end
207

208
# Always disable the database (we never need it just to list module
209
# information).
210
framework_opts = { 'DisableDatabase' => true }
211

212
# If the user only wants a particular module type, no need to load the others
213
if filter.downcase != 'all'
214
  framework_opts[:module_types] = [ filter.downcase ]
215
end
216

217
# Initialize the simplified framework instance.
218
$framework = Msf::Simple::Framework.create(framework_opts)
219

220
if check
221
  columns = [ 'Module', 'Status', 'Reference' ]
222
else
223
  columns = [ 'Module', 'Reference' ]
224
end
225

226
tbl = Rex::Text::Table.new(
227
  'Header' => 'Module References',
228
  'Indent' => 2,
229
  'Columns' => columns
230
)
231

232
bad_refs_count = 0
233

234
$framework.modules.each do |name, mod|
235
  if mod.nil?
236
    elog("module_reference.rb is unable to load #{name}")
237
    next
238
  end
239

240
  next if match and !(name =~ match)
241

242
  x = mod.new
243
  x.references.each do |r|
244
    ctx_id = r.ctx_id.upcase
245
    ctx_val = r.ctx_val
246
    next unless type == 'ALL' || type == ctx_id
247

248
    if check
249
      if types.has_key?(ctx_id)
250
        if ctx_id == 'MSB'
251
          year = ctx_val[2..3]
252
          century = year[0] == '9' ? '19' : '20'
253
          new_ctx_val = "#{century}#{year}/#{ctx_val}"
254
          uri = types[r.ctx_id.upcase].gsub(/\#{in_ctx_val}/, new_ctx_val)
255
        else
256
          uri = types[r.ctx_id.upcase].gsub(/\#{in_ctx_val}/, r.ctx_val.to_s)
257
        end
258

259
        status = is_url_alive(uri, http_timeout, is_url_alive_cache)
260
        bad_refs_count += 1 if status == STATUS_DOWN
261
      else
262
        # The reference ID isn't supported so we don't know how to check this
263
        bad_refs_count += 1
264
        status = STATUS_UNSUPPORTED
265
      end
266
    end
267

268
    ref = "#{r.ctx_id}-#{r.ctx_val}"
269
    new_column = []
270
    new_column << x.fullname
271
    new_column << status if check
272
    new_column << ref
273
    tbl << new_column
274
  end
275
end
276

277
if sort == 1
278
  tbl.sort_rows(1)
279
end
280

281
if sort == 2
282
  tbl.sort_rows(1)
283
  tbl.rows.reverse
284
end
285

286
puts
287
puts tbl.to_s
288
puts
289

290
puts "Number of bad references found: #{bad_refs_count}" if check
291
save_results(save, $csv.nil? ? tbl.to_s : tbl.to_csv) if save
292

293