title: | Chapter 5: Automated Exploits
text: 192.168.86.1
  53
  tcp domain open
  192.168.86.1
  80
  tcp http open
  192.168.86.1
  5000
  tcp upnp open MiniUPnP 1.9 Linux
  3.13.0-115-generic;
  UPnP 1.1
  192.168.86.1
  8080
  tcp http-proxy open
  192.168.86.1
  8081
  tcp blackice-icecap open
  192.168.86.8
  80
  tcp
  http filtered
  192.168.86.9
  80
  tcp http filtered
  192.168.86.20
  49
  tcp tacacs filtered
  192.168.86.20
  80
  tcp http open
  192.168.86.20
  389
  tcp ldap filtered
  192.168.86.20
  1028
  tcp unknown filtered
  192.168.86.20
  1097
  tcp sunclustermgr filtered
  192.168.86.20
  1141
  tcp
  mxomss filtered
  192.168.86.20
  1494
  tcp citrix-ica filtered
  192.168.86.20
  1935
  tcp rtmp filtered
  192.168.86.20
  1998
  tcp x25-svc-port filtered
  192.168.86.20
  2003
  tcp finger filtered
  192.168.86.20
  2043
  tcp isis-bcast filtered
  192.168.86.20
  2710
  tcp
  sso-service filtered
  192.168.86.20
  2910
  tcp tdaccess filtered
  192.168.86.20
  3766
  tcp sitewatch-s filtered
  192.168.86.20
  5989
  tcp wbem-https filtered
  192.168.86.20
  6389
  tcp clariion-evr01 filtered
  192.168.86.20
  7004
  tcp afs3-kaserver filtered
  192.168.86.20
  9001
  tcp
  tor-orport filtered
  192.168.86.20
  49155
  tcp unknown filtered
  192.168.86.20
  61532
  tcp unknown filtered
  192.168.86.21
  22
  tcp ssh open OpenSSH 7.6p1
  Debian
  2
  protocol 2.0
  192.168.86.22
  8008
  tcp http open
  You can also import results from vulnerability scans. Let’s take the output from one of
  our OpenVAS scans. I exported the report into NBE format,
  which is a Nessus-based
  format that Metasploit can read. From there, I imported the file into the database by
  using
  db_import
  followed by the filename.
  shows the process of doing
  the import.
  Example 5-15. Using db_import
  msf > db_import /root/Downloads/report.nbe
  [
  *
  ]
  Importing
  'Nessus NBE Report'
  data
  [
  *
  ]
  Importing host 192.168.86.196
  [
  *
  ]
  Importing host 192.168.86.247
  [
  *
  ]
  Importing host 192.168.86.247
  [
  *
  ]
  Importing host 192.168.86.247
  [
  *
  ]
  Importing host 192.168.86.38
  [
  *
  ]
  Importing host 192.168.86.39
  [
  *
  ]
  Importing host 192.168.86.32
  [
  *
  ]
  Importing host 192.168.86.24
  Metasploit | 163
  [
  *
  ]
  Importing host 192.168.86.33
  [
  *
  ]
  Importing host 192.168.86.42
  [
  *
  ]
  Importing host 192.168.86.37
  [
  *
  ]
  Importing host 192.168.86.36
  [
  *
  ]
  Importing host 192.168.86.25
  [
  *
  ]
  Importing host 192.168.86.22
  [
  *
  ]
  Importing host 192.168.86.45
  [
  *
  ]
  Importing host 192.168.86.49
  [
  *
  ]
  Importing host 192.168.86.162
  [
  *
  ]
  Importing host 192.168.86.170
  [
  *
  ]
  Importing host 192.168.86.160
  [
  *
  ]
  Importing host 192.168.86.156
  [
  *
  ]
  Importing host 192.168.86.40
  [
  *
  ]
  Importing host 192.168.86.1
  [
  *
  ]
  Importing host 192.168.86.26
  [
  *
  ]
  Importing host 192.168.86.218
  [
  *
  ]
  Importing host 192.168.86.249
  [
  *
  ]
  Importing host 192.168.86.27
  [
  *
  ]
  Importing host 192.168.86.9
  [
  *
  ]
  Importing host 192.168.86.8
  [
  *
  ]
  Successfully imported /root/Downloads/report.nbe
  With the results of the vulnerability scan in the database, they become things we can
  look up. Using
  vulns
  , we can list all of the vulnerabilities known in the database. We
  can also narrow the list of vulnerabilities by using command-line parameters. For
  example, if you use
  vulns -p 80
  , you will be listing all the
  vulnerabilities associated
  with port 80. Using
  -s
  , you can search by service name. What you will get is just a list
  of the vulnerabilities. This includes the host information where the vulnerability
  exists, as well as a reference number for the vulnerability. You can also get informa‐
  tion about the vulnerabilities by using
  -i
  , as shown in
  Example 5-16
  .
  This is just part
  of the vulnerability details from one of the vulnerabilities found.
  Example 5-16. Vulnerability information from msfconsole
  Solution:
  Solution
  type
  : Mitigation
  To disable TCP timestamps on linux add the line
  'net.ipv4.tcp_timestamps = 0'
  to
  /etc/sysctl.conf. Execute
  'sysctl -p'
  to apply the settings at runtime.
  To disable TCP timestamps on Windows execute
  'netsh int tcp set global timestamps=disabled'
  Starting
  with Windows Server
  2008
  and Vista, the timestamp cannot be completely
  disabled.
  The default behavior of the TCP/IP stack on this Systems is to not use the
  Timestamp options when initiating TCP connections, but use them
  if
  the TCP peer
  that is initiating communication includes
  them in their synchronize
  (
  SYN
  )
  segment.
  See also: http://www.microsoft.com/en-us/download/details.aspx?id
  =
  9152