UPDATED VERSION: AutoSploit 2.2

2018-07-28T21:35:11
ID PENTESTIT:F170CE33A20BCED5E59E21AB8AE42D95
Type pentestit
Reporter Black
Modified 2018-07-28T21:35:11

Description

PenTestIT RSS Feed

It has been some days since there was a lot of hue and cry about AutoSploit and eventually everything subsided. I wrote about it in a post titled AutoSploit = Shodan/Censys/Zoomeye + Metasploit too. Recently, an updated an improved updated version - AutoSploit 2.2 was released. This post will try to describe the changes between the initial release and the newest version.

AutoSploit 2.2

What is AutoSploit?

> AutoSploit stands for Automated Mass Exploiter. It attempts to automate the exploitation of remote hosts. Targets can be collected automatically through Shodan, Censys or Zoomeye. But options to add your custom targets and host lists have been included as well. The available Metasploit modules have been selected to facilitate Remote Code Execution and to attempt to gain Reverse TCP Shells and/or Meterpreter sessions.

AutoSploit 2.2 Changelog:

This release fixes a few bugs. A brief about them:

  • Issue where relevant module sorting fails fixed
  • Issue where services would not be started fixed
  • Creates a script where you can run AutoSploit easily run_autosploit.sh. This will run AutoSploit in exploit mode against previously discovered hosts in the whitelist.
  • Creates a script where you can dry run AutoSploit dryrun_autosploit.sh. This will search Censys/Shodan/etc. and do a dry-run against discovered hosts that are in the whitelist. VALIDATE THE DRYRUN REPORT BEFORE LAUNCHING THE ACTUAL EXPLOIT.
  • Minor updates and other commits.
  • API keys token file reading error fix: When reading an API key file, tokens are not stripped properly. Non-standard end-lines causes an error with Shodan/Censys/etc APIs
  • Added a dry-run flag. When running without the terminal and the --dry-run flag, msfconsole will not be run. A report will still be produced.
  • Sanitized whitelist comparison with the host file. All leading and trailing white-spaces should be removed before comparing IPs.
  • Added an --exploit-file-to-use option. Load exploits directly from the specified file, do not prompt for exploit-file selection if this option is specified.
  • Added --append/--overwrite to search engines. Specifying either will skip the prompt after a search query. --overwrite will start with a blank file but will append further searches ex: with -s -c --overwrite, both Shodan and Censys results will be appended to a clean file.
  • Search all fix for append/overwrite flags. Search results is not prompted anymore.
  • Modified the Exploiter output. Added a tally at the end. Suppressed much of the output during a dry-run.
  • Bug-fix, --exploit-file-to-use Output an error message to the console if the specified exploit file does not exists.
  • Added short arguments for --append/--overwrite.
  • Closing program if invalid file is passed to --exploit-file-to-use.
  • Removed blocking MSF modules from default module list.
  • Added a fuzzers-only json file.
  • Added a vagrant config to easily deploy AutoSploit to aws-lightsail.
  • Successful exploits will start meterpreter in background.
  • Fixed counter for successful exploits/failed exploits bug, counting success/failure occurrence, not line outputs.
  • Success/failures now grepping escaped MSF output for success/failures.
  • Grepping for keywords such as "Meterpreter", "Session" for success.
  • Completely reworked the OSX installer. It will now install on OSX successfully.

Download AutoSploit:

AutoSploit 2.2 (AutoSploit-2.2.zip/AutoSploit-2.2.tar.gz) can be downloaded from here. Another way is to perform a git pull on the directory to get everything from the source repository.

The post UPDATED VERSION: AutoSploit 2.2 appeared first on PenTestIT.