AutoSploit = Shodan/Censys/Zoomeye + Metasploit

[Que$t]

know, I know that you already have read about AutoSploit and used it probably since word got out about this auto exploitation tool some two months ago. However, between then and now, a lot has changed with the tool and this post is about that.

What is AutoSploit?

AutoSploit is an automated, mass exploitation tool coded in Python that can leverage Shodan, Censys or Zoomeye search engines to locate targets. You can choose either one or all three search engines. It also has an ability to include custom targets that you manually add. The mass exploitation tool then launches relevant Metasploit modules on the discovered targets. By default, there are about 300 pre-defined Metasploit modules that the tool comes out-of-the box with. These have been added with the purpose of code execution affecting different operating systems, web applications, IDS, etc. Of course, again as and when you want to add new modules to this list, simply editing the etc/json/default_modules.json file should be good enough. These modules include some really old exploits like MS01-023 (CVE-2001-0241) affecting Windows operating systems, etc.

Following is a list of the default Metasploit modules that comes with AutoSploit:

    exploit/windows/ftp/ms09_053_ftpd_nlst
    exploit/windows/firewall/blackice_pam_icq
    exploit/windows/http/amlibweb_webquerydll_app
    exploit/windows/http/ektron_xslt_exec_ws
    exploit/windows/http/umbraco_upload_aspx
    exploit/windows/iis/iis_webdav_scstoragepathfromurl
    exploit/windows/iis/iis_webdav_upload_asp
    exploit/windows/iis/ms01_023_printer
    exploit/windows/iis/ms01_026_dbldecode
    exploit/windows/iis/ms01_033_idq
    exploit/windows/iis/ms02_018_htr
    exploit/windows/iis/ms02_065_msadc
    exploit/windows/iis/ms03_007_ntdll_webdav
    exploit/windows/iis/msadc
    exploit/windows/isapi/ms00_094_pbserver
    exploit/windows/isapi/ms03_022_nsiislog_post
    exploit/windows/isapi/ms03_051_fp30reg_chunked
    exploit/windows/isapi/rsa_webagent_redirect
    exploit/windows/isapi/w3who_query
    exploit/windows/scada/advantech_webaccess_dashboard_file_upload
    exploit/windows/ssl/ms04_011_pct
    exploit/freebsd/http/watchguard_cmd_exec
    exploit/linux/http/alienvault_exec
    exploit/linux/http/alienvault_sqli_exec
    exploit/linux/http/astium_sqli_upload
    exploit/linux/http/centreon_sqli_exec
    exploit/linux/http/centreon_useralias_exec
    exploit/linux/http/crypttech_cryptolog_login_exec
    exploit/linux/http/dolibarr_cmd_exec
    exploit/linux/http/goautodial_3_rce_command_injection
    exploit/linux/http/kloxo_sqli
    exploit/linux/http/nagios_xi_chained_rce
    exploit/linux/http/netgear_wnr2000_rce
    exploit/linux/http/pandora_fms_sqli
    exploit/linux/http/riverbed_netprofiler_netexpress_exe
    exploit/linux/http/wd_mycloud_multiupload_upload
    exploit/linux/http/zabbix_sqli
    exploit/linux/misc/qnap_transcode_server
    exploit/linux/mysql/mysql_yassl_getname
    exploit/linux/mysql/mysql_yassl_hello
    exploit/linux/postgres/postgres_payload
    exploit/linux/samba/is_known_pipename
    exploit/multi/browser/java_jre17_driver_manager
    exploit/multi/http/atutor_sqli
    exploit/multi/http/dexter_casinoloader_exec
    exploit/multi/http/drupal_drupageddon
    exploit/multi/http/manage_engine_dc_pmp_sqli
    exploit/multi/http/manageengine_search_sqli
    exploit/multi/http/movabletype_upgrade_exec
    exploit/multi/http/php_volunteer_upload_exe
    exploit/multi/http/sonicwall_scrutinizer_methoddetail_sqli
    exploit/multi/http/splunk_mappy_exec
    exploit/multi/http/testlink_upload_exec
    exploit/multi/http/zpanel_information_disclosure_rce
    exploit/multi/misc/legend_bot_exec
    exploit/multi/mysql/mysql_udf_payload
    exploit/multi/postgres/postgres_createlang
    exploit/solaris/sunrpc/ypupdated_exec
    exploit/unix/ftp/proftpd_133c_backdoor
    exploit/unix/http/tnftp_savefile
    exploit/unix/webapp/joomla_contenthistory_sqli_rce
    exploit/unix/webapp/kimai_sqli
    exploit/unix/webapp/openemr_sqli_privesc_upload
    exploit/unix/webapp/seportal_sqli_exec
    exploit/unix/webapp/vbulletin_vote_sqli_exec
    exploit/unix/webapp/vicidial_manager_send_cmd_exec
    exploit/windows/antivirus/symantec_endpoint_manager_rce
    exploit/windows/http/apache_mod_rewrite_ldap
    exploit/windows/http/ca_totaldefense_regeneratereports
    exploit/windows/http/cyclope_ess_sqli
    exploit/windows/http/hp_mpa_job_acct
    exploit/windows/http/solarwinds_storage_manager_sql
    exploit/windows/http/sonicwall_scrutinizer_sql
    exploit/windows/misc/altiris_ds_sqli
    exploit/windows/misc/fb_cnct_group
    exploit/windows/misc/lianja_db_net
    exploit/windows/misc/manageengine_eventlog_analyzer_rce
    exploit/windows/mssql/lyris_listmanager_weak_pass
    exploit/windows/mssql/ms02_039_slammer
    exploit/windows/mssql/ms09_004_sp_replwritetovarbin
    exploit/windows/mssql/ms09_004_sp_replwritetovarbin_sqli
    exploit/windows/mssql/mssql_linkcrawler
    exploit/windows/mssql/mssql_payload
    exploit/windows/mssql/mssql_payload_sqli
    exploit/windows/mysql/mysql_mof
    exploit/windows/mysql/mysql_start_up
    exploit/windows/mysql/mysql_yassl_hello
    exploit/windows/mysql/scrutinizer_upload_exec
    exploit/windows/postgres/postgres_payload
    exploit/windows/scada/realwin_on_fcs_login
    exploit/multi/http/rails_actionpack_inline_exec
    exploit/multi/http/rails_dynamic_render_code_exec
    exploit/multi/http/rails_json_yaml_code_exec
    exploit/multi/http/rails_secret_deserialization
    exploit/multi/http/rails_web_console_v2_code_exec
    exploit/multi/http/rails_xml_yaml_code_exec
    exploit/multi/http/rocket_servergraph_file_requestor_rce
    exploit/multi/http/phpmoadmin_exec
    exploit/multi/http/phpmyadmin_3522_backdoor
    exploit/multi/http/phpmyadmin_preg_replace
    exploit/multi/http/phpscheduleit_start_date
    exploit/multi/http/phptax_exec
    exploit/multi/http/phpwiki_ploticus_exec
    exploit/multi/http/plone_popen2
    exploit/multi/http/pmwiki_pagelist
    exploit/multi/http/joomla_http_header_rce
    exploit/multi/http/novell_servicedesk_rce
    exploit/multi/http/oracle_reports_rce
    exploit/multi/http/php_utility_belt_rce
    exploit/multi/http/phpfilemanager_rce
    exploit/multi/http/processmaker_exec
    exploit/multi/http/rocket_servergraph_file_requestor_rce
    exploit/multi/http/spree_search_exec
    exploit/multi/http/spree_searchlogic_exec
    exploit/multi/http/struts_code_exec_parameters
    exploit/multi/http/vtiger_install_rce
    exploit/multi/http/werkzeug_debug_rce
    exploit/multi/http/zemra_panel_rce
    exploit/multi/http/zpanel_information_disclosure_rce
    exploit/multi/http/joomla_http_header_rce
    exploit/unix/webapp/joomla_akeeba_unserialize
    exploit/unix/webapp/joomla_comjce_imgmanager
    exploit/unix/webapp/joomla_contenthistory_sqli_rce
    exploit/unix/webapp/joomla_media_upload_exec
    exploit/multi/http/builderengine_upload_exec
    exploit/multi/http/caidao_php_backdoor_exec
    exploit/multi/http/atutor_sqli
    exploit/multi/http/ajaxplorer_checkinstall_exec
    exploit/multi/http/apache_activemq_upload_jsp
    exploit/unix/webapp/wp_lastpost_exec
    exploit/unix/webapp/wp_mobile_detector_upload_execute
    exploit/multi/http/axis2_deployer
    exploit/unix/webapp/wp_foxypress_upload
    exploit/linux/http/tr064_ntpserver_cmdinject
    exploit/linux/misc/quest_pmmasterd_bof
    exploit/multi/http/wp_ninja_forms_unauthenticated_file_upload
    exploit/unix/webapp/php_xmlrpc_eval
    exploit/unix/webapp/wp_admin_shell_upload
    exploit/linux/http/sophos_wpa_sblistpack_exec
    exploit/linux/local/sophos_wpa_clear_keys
    exploit/multi/http/zpanel_information_disclosure_rce
    auxiliary/admin/cisco/cisco_asa_extrabacon
    auxiliary/admin/cisco/cisco_secure_acs_bypass
    auxiliary/admin/cisco/vpn_3000_ftp_bypass
    exploit/bsdi/softcart/mercantec_softcart
    exploit/freebsd/misc/citrix_netscaler_soap_bof
    exploit/freebsd/samba/trans2open
    exploit/linux/ftp/proftp_sreplace
    exploit/linux/http/dcos_marathon
    exploit/linux/http/f5_icall_cmd
    exploit/linux/http/fritzbox_echo_exec
    exploit/linux/http/gitlist_exec
    exploit/linux/http/goautodial_3_rce_command_injection
    exploit/linux/http/ipfire_bashbug_exec
    exploit/linux/http/ipfire_oinkcode_exec
    exploit/linux/http/ipfire_proxy_exec
    exploit/linux/http/kaltura_unserialize_rce
    exploit/linux/http/lifesize_uvc_ping_rce
    exploit/linux/http/nagios_xi_chained_rce
    exploit/linux/http/netgear_dgn1000_setup_unauth_exec
    exploit/linux/http/netgear_wnr2000_rce
    exploit/linux/http/nuuo_nvrmini_auth_rce
    exploit/linux/http/nuuo_nvrmini_unauth_rce
    exploit/linux/http/op5_config_exec
    exploit/linux/http/pandora_fms_exec
    exploit/linux/http/pineapple_preconfig_cmdinject
    exploit/linux/http/seagate_nas_php_exec_noauth
    exploit/linux/http/symantec_messaging_gateway_exec
    exploit/linux/http/trendmicro_imsva_widget_exec
    exploit/linux/http/trueonline_billion_5200w_rce
    exploit/linux/http/trueonline_p660hn_v1_rce
    exploit/linux/http/trueonline_p660hn_v2_rce
    exploit/linux/http/vcms_upload
    exploit/linux/misc/lprng_format_string
    exploit/linux/misc/mongod_native_helper
    exploit/linux/misc/ueb9_bpserverd
    exploit/linux/mysql/mysql_yassl_getname
    exploit/linux/pop3/cyrus_pop3d_popsubfolders
    exploit/linux/postgres/postgres_payload
    exploit/linux/pptp/poptop_negative_read
    exploit/linux/proxy/squid_ntlm_authenticate
    exploit/linux/samba/lsa_transnames_heap
    exploit/linux/samba/setinfopolicy_heap
    exploit/linux/samba/trans2open
    exploit/multi/elasticsearch/script_mvel_rce
    exploit/multi/elasticsearch/search_groovy_script
    exploit/multi/http/atutor_sqli
    exploit/multi/http/axis2_deployer
    exploit/multi/http/familycms_less_exe
    exploit/multi/http/freenas_exec_raw
    exploit/multi/http/gestioip_exec
    exploit/multi/http/glassfish_deployer
    exploit/multi/http/glpi_install_rce
    exploit/multi/http/joomla_http_header_rce
    exploit/multi/http/makoserver_cmd_exec
    exploit/multi/http/novell_servicedesk_rc
    exploit/multi/http/oracle_reports_rce
    exploit/multi/http/php_utility_belt_rce
    exploit/multi/http/phpfilemanager_rce
    exploit/multi/http/phpmyadmin_3522_backdoor
    exploit/multi/http/phpwiki_ploticus_exec
    exploit/multi/http/processmaker_exec
    exploit/multi/http/rails_actionpack_inline_exec
    exploit/multi/http/rails_dynamic_render_code_exec
    exploit/multi/http/rails_secret_deserialization
    exploit/multi/http/rocket_servergraph_file_requestor_rce
    exploit/multi/http/simple_backdoors_exec
    exploit/multi/http/spree_search_exec
    exploit/multi/http/spree_searchlogic_exec
    exploit/multi/http/struts2_rest_xstream
    exploit/multi/http/struts_code_exec
    exploit/multi/http/struts_code_exec_classloader
    exploit/multi/http/struts_code_exec_parameters
    exploit/multi/http/struts_dev_mode
    exploit/multi/http/sysaid_auth_file_upload
    exploit/multi/http/tomcat_jsp_upload_bypass
    exploit/multi/http/vtiger_install_rce
    exploit/multi/http/werkzeug_debug_rce
    exploit/multi/http/zemra_panel_rce
    exploit/multi/http/zpanel_information_disclosure_rce
    exploit/multi/ids/snort_dce_rpc
    exploit/multi/misc/batik_svg_java
    exploit/multi/misc/pbot_exec
    exploit/multi/misc/veritas_netbackup_cmdexec
    exploit/multi/mysql/mysql_udf_payload
    exploit/multi/php/php_unserialize_zval_cookie
    exploit/unix/http/freepbx_callmenum
    exploit/unix/http/lifesize_room
    exploit/unix/http/pfsense_clickjacking
    exploit/unix/http/pfsense_group_member_exec
    exploit/unix/http/tnftp_savefile
    exploit/unix/misc/polycom_hdx_traceroute_exec
    exploit/unix/webapp/awstats_migrate_exec
    exploit/unix/webapp/carberp_backdoor_exec
    exploit/unix/webapp/citrix_access_gateway_exec
    exploit/unix/webapp/dogfood_spell_exec
    exploit/unix/webapp/invision_pboard_unserialize_exec
    exploit/unix/webapp/joomla_contenthistory_sqli_rce
    exploit/unix/webapp/mybb_backdoor
    exploit/unix/webapp/opensis_modname_exec
    exploit/unix/webapp/oscommerce_filemanager
    exploit/unix/webapp/piwik_superuser_plugin_upload
    exploit/unix/webapp/tikiwiki_upload_exec
    exploit/unix/webapp/webtester_exec
    exploit/unix/webapp/wp_phpmailer_host_header
    exploit/unix/webapp/wp_total_cache_exec
    exploit/windows/antivirus/symantec_endpoint_manager_rce
    exploit/windows/http/ektron_xslt_exec
    exploit/windows/http/ektron_xslt_exec_ws
    exploit/windows/http/geutebrueck_gcore_x64_rce_bo
    exploit/windows/http/hp_autopass_license_traversal
    exploit/windows/http/manage_engine_opmanager_rce
    exploit/windows/http/netgear_nms_rce
    exploit/windows/http/sepm_auth_bypass_rce
    exploit/windows/http/trendmicro_officescan_widget_exec
    exploit/windows/iis/iis_webdav_upload_asp
    exploit/windows/iis/msadc
    exploit/windows/misc/manageengine_eventlog_analyzer_rce
    exploit/windows/novell/file_reporter_fsfui_upload
    exploit/windows/scada/ge_proficy_cimplicity_gefebt
    exploit/windows/smb/ipass_pipe_exec
    exploit/windows/smb/smb_relay
    auxiliary/sqli/oracle/jvm_os_code_10g
    auxiliary/sqli/oracle/jvm_os_code_11g
    auxiliary/fuzzers/dns/dns_fuzzer
    auxiliary/fuzzers/ftp/client_ftp
    auxiliary/fuzzers/ftp/ftp_pre_post
    auxiliary/fuzzers/http/http_form_field
    auxiliary/fuzzers/http/http_get_uri_long
    auxiliary/fuzzers/http/http_get_uri_strings
    auxiliary/fuzzers/ntp/ntp_protocol_fuzzer
    auxiliary/fuzzers/smb/smb2_negotiate_corrupt
    auxiliary/fuzzers/smb/smb_create_pipe
    auxiliary/fuzzers/smb/smb_create_pipe_corrupt
    auxiliary/fuzzers/smb/smb_negotiate_corrupt
    auxiliary/fuzzers/smb/smb_ntlm1_login_corrupt
    auxiliary/fuzzers/smb/smb_tree_connect
    auxiliary/fuzzers/smb/smb_tree_connect_corrupt
    auxiliary/fuzzers/smtp/smtp_fuzzer
    auxiliary/fuzzers/ssh/ssh_kexinit_corrupt
    auxiliary/fuzzers/ssh/ssh_version_15
    auxiliary/fuzzers/ssh/ssh_version_2
    auxiliary/fuzzers/ssh/ssh_version_corrupt
    auxiliary/fuzzers/tds/tds_login_corrupt
    auxiliary/fuzzers/tds/tds_login_username

Installation of the tool is pretty simple and won’t need anything on Kali Linux, however this tool can also be Dockerized. Post installation, you are requested for your Shodan and Censys API credentials, which as stored in /AutoSploit/etc/tokens/shodan.key and /AutoSploit/etc/tokens/censys.key respectively.

All in all a good tool if you know what you are doing as you need some configuration of this tool to actually get a shell. The default module list also won’t help much as the exploits are pretty old and you may end with some low hanging fruits eventually and I do not really know the brouhaha behind the release of this tool by the people in this security industry.

Now about the newer features in the latest AutoSploit release. This release has a few bug fixes and three new features. A feature that I like in this release is the addition of an exploit reporting feature. Metasploit output is captured and saved to a report file. Additionally, a .rc script file for every module ran against a given host is also created, allowing you to reproduce whatever caused an exploit to work. Another feature in this release is the introduction of a command whitelist which contains a list of items allowed commands, blocking all others not included in this list.

Download AutoSploit:

The latest version of this mass exploitation tool was released 4 days ago – AutoSploit v2.1 (AutoSploit-2.1.zip/AutoSploit-2.1.tar.gz), which can be downloaded from [Ссылки могут видеть только зарегистрированные пользователи. ]. Another way is to perform a git pull on the directory to get everything from the source repository.