Forums > How To Create A Powerful Exploit Tree/database

Full Version: How To Create A Powerful Exploit Tree/database

t3ctrix

Aug 30 2006, 05:36 PM

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
>> How To Create A Powerful Exploit Tree (For Personal Use) <<
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
by t3ctrix
Email: t3ctrix[at]gmail[dot]com

Note From Author:
-----------------
This tutorial released under the GNU General Public License. A copy of this license can be found at http://www.fsf.org/licenses/gpl.html. Unofficial translations can also be found at http://www.fsf.org/licenses/translations.html.

In this guide I'll show how to create and update a powerful exploit tree for personal use on Linux Box. I'll provide necessary codes, reference, and give details on how to setup an exploit database using various web resources. I'll use following websites directly or indrectly for codes, programs and exploits database.

1. http://www.remote-exploit.org/ [For backtrack + milworm and securityfocus exploits update script]
2. hackingdefined.com [For exploits CVS]
3. packetstormsecurity.org [For exploits database]
4. http://anyside.org/ [For exploits database]
5. http://secwatch.org/ [For exploits database]
6. http://www.brandonhutchinson.com/ [For packetstormsecurity exploits update script]
7. http://www.securityforest.com/ [For exploits database and securityforest exploits update script]
8. http://www.gnu.org/software/wget/ [For Wget]

Let the game begin...

**********
* PART 1 *
**********

Setting up Milw0rm and Securityfocus exploits database
------------------------------------------------------
Backtrack ships with Milw0rm and Securityfocus exploits archive update scripts using cvs from hackingdefined.com (seems like it's no longer maintained). I'll use the same for the first part of our guide.

.:Code listing:.
1. Setting Up
-------------

CODE

# cd /
# mkdir -p pentest/exploits
# cd /pentest/exploits
# mkdir milw0rm secfocus anyside secwatch bin forest

2. Milw0rm.com
---------------
a. Create a file "makeindex-milw0rm" and paste the following script

CODE

#!/bin/bash
rm -rf sploitlist.txt
find . -xtype f >allfiles.txt
for file in $(cat allfiles.txt);do
echo $file $(head -n 1 $file|cut -d" " -f2-30)|grep -v CVS >>sploitlist.txt
done

b. Save the file under /pentest/exploits/milw0rm directory.
c. Save a copy inside /pentest/exploits/bin directory.
d. Create a file "update-milw0rm" and paste the following script.

CODE

#!/bin/bash
echo "Milw0rm Exploit CVS Update script"
CVSROOT=:pserver:anonymous@www.hackingdefined.com:/root;export CVSROOT
echo "Logging in - Press Enter when prompted"
cvs login
echo "Updating Exploits"
cvs update milw0rm
echo "Generating Local Database, please Wait"
cp bin/makeindex-milw0rm milw0rm/
cd milw0rm
./makeindex-milw0rm

Save it under /pentest/exploits directory
3. Assign proper permissions to all the files we've just created

CODE

# chmod +x /pentest/exploits/milw0rm/makeindex-milw0rm
# chmod +x /pentest/exploits/update-milw0rm
# chmod +x /pentest/exploits/bin/makeindex-milw0rm

3. Securityfocus.com
---------------------
a. Create a file "makeindex-secfocus" with follwing script

CODE

#!/bin/bash
rm -rf sploitlist.txt
curdir=`pwd`;
find ./ -type d |cut -d"/" -f2 > dirlisttmp.txt
#tail -n 2 dirlisttmp.txt > dirlist.txt
for dir in $(cat dirlisttmp.txt);do
cd $curdir
cd $dir
echo $dir $(cat bid*.txt 2>/dev/null) >>../sploitlist.txt
cd ..
#rm -rf dirlist*
done

b. Save the file under /pentest/exploits/secfocus directory.
c. Save a copy inside /pentest/exploits/bin directory.
d. Create a file "update-secfocus" and paste the following script.

CODE

#!/bin/bash
echo "Milw0rm Exploit CVS Update script"
CVSROOT=:pserver:anonymous@www.hackingdefined.com:/root;export CVSROOT
echo "Logging in - Press Enter when prompted"
cvs login
echo "Updating Exploits"
cvs update secfocus
cp bin/makeindex-secfocus secfocus/
echo "Generating Local Database, please Wait"
cd secfocus
./makeindex-secfocus

Save it under /pentest/exploits directory
3. Assign proper permissions

CODE

# chmod +x /pentest/exploits/secfocus/makeindex-secfocus
# chmod +x /pentest/exploits/update-secfocus
# chmod +x /pentest/exploits/bin/makeindex-secfocus

4. PacketStormSecurity.org
---------------------------
1. Create a "packetstorm" directory inside /pentest/exploits

CODE

# cd
# mkdir /pentest/exploits/packetstorm

2. Create a file "downloadpacket.sh" with following script

CODE

#!/bin/sh

# Destination directory
EXPLOITS_DIR=/pentest/exploits/packetstorm

# First year for which annual compilations are not available
STARTING_YEAR=2006

CURRENT_YEAR=`date +%Y`

# Create the exploits destination directory if it does not exist
[ ! -d $EXPLOITS_DIR ] && mkdir $EXPLOITS_DIR
cd $EXPLOITS_DIR

# Retrieve annual exploit bundles; skip them if already downloaded
#for YEAR in 1999 2000 2001 2002
#do
#   TWO_DIGIT_YEAR=`echo $YEAR | cut -c3-4`
#   [ -f ${YEAR}-exploits.tgz ] && continue
#   echo -e "Retrieving $YEAR annual exploit bundle...\n"
#   wget http://packetstormsecurity.org/${TWO_DIGIT_YEAR}12-exploits/${YEAR}-exploits.tgz
#done

# Retrieve monthly exploit bundles; skip them if already downloaded
while [ "$STARTING_YEAR" -le "$CURRENT_YEAR" ]
do
   # Download the full year's worth of monthly exploit bundles
   YEAR=`echo $STARTING_YEAR | cut -c3-4`
   for MONTH in Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
   do
      FULL_MONTH=`date -d 1${MONTH} +%B`
      NUMERIC_MONTH=`date -d 1${MONTH} +%m`
      [ -f ${YEAR}${NUMERIC_MONTH}-exploits.tgz ] && continue
      echo -e "Retrieving ${FULL_MONTH} 20${YEAR} exploit bundle...\n"
      wget http://packetstormsecurity.org/${YEAR}${NUMERIC_MONTH}-exploits/${YEAR}${NUMERIC_MONTH}-exploits.tgz
   done
   STARTING_YEAR=`expr $STARTING_YEAR + 1`
done

3. Assign appropriate permissions

CODE

# cd
# chmod +x /pentest/exploits/downloadpacket.sh

5. SecurityForest.com
----------------------
1. Create a file "ExploitTree.pl" with following script

CODE

#!/usr/bin/perl
#
# Coded by Loni - loni@securityforest.com
# Updated:  12/02/2005
#
# Client Utility for the ExploitTree CVS Repository on SecurityForest.com

$ver = "v0.6";
$name = "ExploitTree.pl";

$winexe = "no"; #Only applicable when distributed as an exe with binary unix utilities
if ($winexe eq "yes") {
    $name = "ExploitTree.exe";
    $dir = $0; $dir =~ s/\\$name//;
    $ENV{'PATH'} = "$dir\\bin;$ENV{'PATH'}";
}

if ($#ARGV < 0) { &usage(); } $username = @ARGV[0];

sub usage {
    print "ExploitTree $ver\nCoded by Loni - loni\@securityforest.com\nhttp:\/\/www.SecurityForest.com\n\n";
    print "Normal Usage:\n";
    print " - Run this tool from the directory that already or will contain\n";
    print "   the directory ExploitTree.\n";
    print " - To download the repository run \"$name anonymous\" (blank password).\n\n";
    print "ExploitTree Administrators and Contributers Usage:\n";
    print " - To log in to the repository run \"$name <your_nick>\", enter your\n";
    print "   password when prompted.\n";
    print " - When updating the repository, close the default editor\n";
    print "   and then c\<enter\> to continue when prompted.\n";
    print "   eg. vi:      type \:q\<enter\>\n";
    print "   eg. nano:    type \<ctrl\>x\n";
    print "   eg. notepad: type \<alt\>f,x\n\n";
    exit(1);
}

$server = "cvs.securityforest.com"; $rep = "\/home/security/cvsroot";

$loggedin = 0;
$refreshbranches = 1;
&master();

sub master {
    if ($username eq "anonymous") {
        print "\nExploitTree Client Utility Manager $ver\n----------------------------------------\n\n";
        print "1\) Initialize (first time download)\n";
        print "2\) Update Repository\n";
        print "3\) Print Exploit Statistics\n";
        print "q\) Quit\n\n> ";
        chomp($choice = <STDIN>);
        if ($choice == 1) { &login($username); &initial_download(); }
        if ($choice == 2) { &version(); &login($username); &update_local(); }
        if ($choice == 3) { &version(); &stats(); print "\nHit Enter to continue>"; <STDIN>; &master(); }
        elsif ($ch_list == "q") { print "Quiting...\n"; exit(1); }
    } else {
        print "\nExploitTree Client Utility Admin Manager $ver\n----------------------------------------\n\n";
        print "1\) Initialize (first time download)\n";
        print "2\) Update Local Copy\n";
        print "3\) Update Repository - Upload files from one local branch\n";
        print "4\) Update Repository - Add & upload ALL new branches from\n";
        print "                       local copy\n";
        print "5\) Update Repository - Add & upload ALL new branches\/files from\n";
        print "                       local copy *recursivly* (ie. slow)\n";
        print "6\) Print Exploit Statistics\n";
        print "+---------------------------------------\nq\) Quit\n\n> ";
        chomp($choice = <STDIN>);
        if ($choice == 1) { &login($username); &initial_download();}
        if ($choice == 2) { &version(); &login($username); &update_local(); &master();}
        if ($choice == 3) { &version(); &login($username); &branches(); &update_repos_one(); &master();}
        if ($choice == 4) { &version(); &login($username); &new_branches(); &branches(); &update_repos_one();

&commit(); &master();}
        if ($choice == 5) { &version(); &login($username); &new_branches(); &branches(); &update_repos_all();

&commit(); &master();}
        if ($choice == 6) { &version(); &stats(); print "\nHit Enter to continue>"; <STDIN>; &master(); }
        elsif ($ch_list == "q") { print "Quiting...\n"; exit(1); }
    }
}

sub version {
    @latest_ver = &readfile("ExploitTree\/_Ver");
    chomp($latest_ver[0]); chop($latest_ver[0]);
    if ($latest_ver[0] ne $ver) {
        print "Please use $name $latest_ver[0] - Available at SecurityForest.com\n";
        print "http:\/\/www.securityforest.com\/downloads\/ExploitTree-pl.tar.gz or ExploitTree-Win32.zip";
        exit(1);
    }
}

sub branches {
    if ($refreshbranches == 1) {
        undef(@branches);
        system("cd ExploitTree && ls -R * |grep : |grep -v CVS > ../branches.txt && cd ..");
        @branches_tmp = &readfile("branches.txt");
        foreach $branch_tmp (@branches_tmp) {
            chomp($branch_tmp);
            if ($winexe eq "yes") { $branch_tmp=~s/=://; } else { $branch_tmp=~s/://; }
            push(@branches,$branch_tmp);
        }
        $refreshbranches == 0;
    }
}

sub new_branches {
    $refreshbranches = 1;
    undef(@branches2);
    system("cd ExploitTree && ls -R * > ../branches2.txt && cd ..");
    @branches_tmp2 = &readfile("branches2.txt");
    $bdots=0;
    $branch_has_SF="no";
    foreach $branch_tmp2 (@branches_tmp2) {
        chomp($branch_tmp2);
        if ($branch_tmp2=~/:/) { if ($bdots == 0) { $branch_tmp3 = $branch_tmp2; } $bdots++; }
        if ($branch_tmp2=~/_SecurityForest/) { $branch_has_SF="yes"; }
        if ($bdots == 1 && $branch_has_SF eq "yes" ) { $bdots=0; $branch_has_SF="no"; }
        else {
            if ($bdots == 2) { if ($branch_tmp3!~/CVS/) {
                if ($winexe eq "yes") { $branch_tmp3=~s/=://; } else { $branch_tmp3=~s/://; }
                push(@branches2,$branch_tmp3);
            }
            $branch_tmp3 = $branch_tmp2; $bdots=1;
            }
        }
    }
    $branch_num2 = 0;
    for $branch_num2 (0..$#branches2) { &addbranch($branch_num2); }
}

sub readfile {        #read in a files contents
    undef @readfile_contents;
    my ($readfile) =  @_;
    open READFILE, $readfile or die "Cannot open $readfile for read :$!\n";
    while (<READFILE>) { push (@readfile_contents, $_); }
    close READFILE;
    return(@readfile_contents);
}

sub login {
    my ($username) = @_;
    if ($username eq "anonymous") { print "Password is blank (press enter), then wait...\n\n"; }
    $cvsconnect = "cvs -d:pserver:$username\@$server:$rep";
    if ($loggedin == 0) { system("$cvsconnect login"); $loggedin = 1; }
}

sub initial_download { system("$cvsconnect -z5 co ExploitTree"); }

sub update_local { system("cd ExploitTree && $cvsconnect update -dP && cd .."); }
# -d (build directories if new directories have been added to the repository since your
# checkout or last update) and -P (leave empty directories out of your working copy)

sub update_repos_one() {
    $branch_num = "0";
    print "\nChoose a branch to update\n-----------------------------\n";
    foreach $branch (@branches) { print "$branch_num\) $branch\n"; $branch_num++; }
    print "\nbranch> ";
    chomp($branch_choice = <STDIN>);
    &update($branch_choice);
}

sub update_repos_all {
    $branch_num = 0;
    for $branch_num (0..$#branches) { &update($branch_num); }
}

sub update {
    my ($branch_num) = @_;
    print "Updating @branches[$branch_num]\n";
    system("cd ExploitTree && $cvsconnect add @branches[$branch_num]\/*.* && cd ..");
    system("cd ExploitTree && $cvsconnect commit @branches[$branch_num] && cd ..");
}

sub addbranch {
    my ($branch_num) = @_;
    print "Adding @branches2[$branch_num2]\n";
    system("cd ExploitTree && $cvsconnect add @branches2[$branch_num2] && cd ..");
    system("cd ExploitTree && cp _SecurityForest @branches2[$branch_num2] && cd ..");
    system("cd ExploitTree && $cvsconnect add @branches2[$branch_num2]\/_SecurityForest && cd ..");
}

sub commit { system("cd ExploitTree && $cvsconnect commit && cd .."); }

sub stats {
    print "Please wait while calculating...";
    system("ls -R ExploitTree | grep -v \":\\|CVS\\|Entries\\|Entries.Log\\|Repository\\|Root\\|_SecurityForest\" | grep

. | grep -e [*.*] | wc -l > stats.txt");
    @stats = &readfile("stats.txt");
    print "\nTotal Exploits: $stats[0]\n";
}

#EOF

and save it under /pentest/exploits/forest directory
2. Assign appropriate permissions

CODE

# chmod +x /pentest/exploits/forest/ExploitTree.pl

6. Anyside.org
---------------

For this part of tutorial i'll use Wget from http://www.gnu.org/software/wget/ You can also use your favorite website copier but make sure it comes with incremental/differential update feature.

1. Download appropriate source file from http://www.gnu.org/software/wget/ and compile it (Don't ask me how!)
2. Create a directory "anyside" under /pentest/exploits/ followed by Exploits under /pentest/exploits/anyside. Write an appropriate update script.

CODE

# mkdir -p /pentest/exploits/anyside/Exploits
# cd /pentest/exploits/anyside/Exploits
# echo "wget http://www.anyside.org/exp/ -l 2 -r -c" > update.sh
# chmod +x update.sh

7. Secwatch.org
----------------
1. Create a directory "secwatch" under /pentest/exploits/ followed by Exploits under /pentest/exploits/secwatch. Write an appropriate update script.

CODE

# mkdir -p /pentest/exploits/secwatch/Exploits
# cd /pentest/exploits/secwatch/Exploits
# echo "wget http://www.anyside.org/exp/ -l 2 -r -c" > update.sh
# chmod +x update.sh

**********
* PART 2 *
**********

Updating Milw0rm exploits database
----------------------------------

CODE

# cd /pentest/exploits/
# ./update-milworm

Updating Securityfocus exploits database
----------------------------------------

CODE

# cd /pentest/exploits/
# ./update-secfocus

Updating PacketStormSecurity.org exploits database
--------------------------------------------------

CODE

# cd /pentest/exploits/
# ./downloadpacket.sh

Updating SecurityForest exploits database
-----------------------------------------

CODE

# cd /pentest/exploits/forest
# perl ./ExploitTree.pl anonymous

*Note: If you are updating your database for the first time select 1 or else select 2

Updating Anyside exploits database
----------------------------------

Do the following if you are updating the database for the first time:

CODE

# cd /pentest/exploits/anyside/Exploits
# wget http://www.anyside.org/exp/ -l 2 -r

Do the following to update your database

CODE

# cd /pentest/exploits/anyside/Exploits
# ./update.sh

Updating Secwatch.org exploits database
------------------------------------
Do the following if you are updating the database for the first time:

CODE

# cd /pentest/exploits/secwatch/Exploits
# wget http://secwatch.org/exploits/ -l 2 -r

Do the following to update your database

CODE

# cd /pentest/exploits/secwatch/Exploits
# ./update.sh

**********
* PART 3 *
**********

Searching Through The Database
------------------------------

In this part of the tutorial, I'll show how to search through some of the databases for particula exploits [Cisco exploits for instance]

1. Searching through Milw0rm exploits database

CODE

# cd /pentest/exploits/milw0rm
# cat sploitlist.txt | grep Cisco

2. Searching through Securityfocus exploits database

CODE

# cd /pentest/exploits/secfocus
# cat sploitlist.txt | grep Cisco

3. Searching through Anyside.org exploits database

CODE

# cd /pentest/exploits/anyside/www.anyside.org/exp
# cat exploits_list.db | grep Cisco

4. Searching through Securityforest.com exploits database

CODE

# cd /pentest/exploits/forest/ExploitTree
# perl ./perl xsearch2-beta.pl

This spawns an interactive menu which can be used to search exploits via BID, exploit name, keyword, exploit name/keyword. Select 3 for intance if you want to search exploit via keyword and type "Cisco" followed by return key. This will give a list of available Cisco exploits. Press 'q' to quit.

Final Note: Use following websites as references for more information on sploits:
----------------
a} http://www.governmentsecurity.org/exploits.php
b} http://insecure.org/sploits.html
c} http://www.securiteam.com/exploits/
d} http://www.iss.net/security_center/advice/...its/default.htm
e} http://www.hoobie.net/security/exploits/

Happy Exploiting !!

>>EOF<<

dfx

Sep 7 2006, 12:59 AM

Man that's a really awesome writeup! I might just have to try it.

And a shortcut to creating parent and child directories at the same time would be to use the -p parameter with mkdir. So it would be mkdir -p parent/child1/child2 and all three are created at one time.

t3ctrix

Sep 7 2006, 04:11 AM

dfx, the shortcut is now implemented on the modified-'n-updated version of the tutorial.

cheers,
t3ctrix

Kenny

Sep 8 2006, 11:34 AM

clear instructions.. handy to implement...very good

upgraded to full member status

regards

bonarez

Sep 8 2006, 01:23 PM

small correction/question

in part 1-2-b (milw0rm) you say:

QUOTE

b. Save the file under /pentest/exploits/milw0rm directory.

but in the chmod +x you say:

QUOTE

# chmod +x /pentest/exploits/makeindex-milw0rm

I assume the file has to be saved under exploits (not milw0rm)

could you confirm/correct that pls

EDIT: same problem with securityfocus.. maybe rest too, I'll check it

EDIT2: another small correction:

in part1-4-1 (packetstorm) you ask to create a packetstorm dir, but it has already been create by command:

CODE

# mkdir milw0rm secfocus packetstorm anyside secwatch bin

in part1-1

EDIT3: we're allmost there

the forest dir is not created by the first mkdir command, so you might like to add it there..

ps: nice tuto, I only used exploittree..

t3ctrix

Sep 13 2006, 08:24 AM

Regards to Kenny, thanks and much appreciated.

bonarez, the file "makeindex-milw0rm" should be saved under /pentest/exploits/milw0rm/ and not /pentest/exploits/. Similarly, the file "makeindex-secfocus" should be saved under /pentest/exploits/secfocus/ and not /pentest/exploits/. I've modified the tutorial and it looks good now. Packetstorm directory duplication has also been fixed. Thanks for pointing it out.

Oh yeah, I apologize for the late reply...but again good things come late

cheers,
t3ctrix

bonarez

Sep 13 2006, 09:25 AM

QUOTE

Thanks for pointing it out.

my pleasure, don't you love it when things are perfect..

ps: congrats on the upgrade, well earned!

whisker

May 27 2007, 07:45 AM

I've been looking this script for long time.....excelent...BTW are you running as root ? when you made this script? can this be made as normal user instead of root?

What about script for milw0rm..? I tried but no luck..

CODE

Milw0rm Exploit CVS Update script
Logging in - Press Enter when prompted
Logging in to :pserver:anonymous@www.hackingdefined.com:2401/root
CVS password:
cvs [login aborted]: connect to www.hackingdefined.com(212.150.53.163):2401 failed: Connection refused
Updating Exploits
cvs [update aborted]: connect to www.hackingdefined.com(212.150.53.163):2401 failed: Connection refused
Generating Local Database, please Wait
find: -xtype: unknown expression primary

What did I do wrong?

Tyler

Jun 1 2007, 01:08 AM

@ t3ctrix, Great Post, I would have to recommend you as a specialist on GSO forums, all of your posts have been great and well thought out, I hope the mods and admins see that. Best Regards, Tyler

NoUse

Jun 21 2007, 02:45 AM

Pretty cool tutorial. Although I don't find it much of an inconvenience to just go to the sites and search, but this could save time I suppose.

Eduardo

Jun 22 2007, 05:43 AM

oooh I have never commented on this post...my bad!

very good and detailed tutorial on how to create an exploit database, also the db is very organized as I see in the tut. Congratz T3ctrix

@Tyler

If you read the entire topic you would have realised Kenny, which is an admin here, noticed T3ctrix made a good and already upgraded him. But as he was a trial member at that time (topic dates are important too

) Kenny upgraded him to full member status. It is all a matter of paying some attention, buddy. In the other topic you asked if an icon file was a keylogger... hehe what a sense of humour.

sucounix

Aug 20 2007, 11:21 AM

alot of thnx

wiz561

Sep 17 2007, 06:37 PM

I have the same problem you did. "Connection Refused".

QUOTE(whisker @ May 27 2007, 07:45 AM)

CODE

What did I do wrong?

mizr

Sep 25 2007, 09:15 AM

thanx alot

[Edited: Glyph: Useless Thanks Post: READ THE RULES!!!]

AdmiralB

Sep 27 2007, 02:01 AM

well its an tutorial
very cool to use once u implement such a system
of course the same-o problems is that most of the databases might run out of date pretty quick
and some of the more powerful exploits are not listed

but other than that, great job!!
cheers~

l0wkey

Sep 27 2007, 07:59 PM

Wow I really found this guide VERY useful, awesome work.

antivirus

Dec 1 2007, 01:45 PM

Thanks for your nice post brother. One of the coolest part of your script is its updatig feature. If someone add this update code to corn then it will update autometicaly after a period. really really nice

MrAexo

Jan 22 2008, 07:32 PM

Does anyone have an updated version of this? Seems some of the update sites are not around now... or perhaps they're just not available right now.

Brabbit

Jan 22 2008, 09:48 PM

cool tutorial mate ... this exploit database is propably gona be useful for experienced hackers and security pro's...nice work

EXPLOITER

Feb 9 2008, 08:27 AM

that was Really Great ..Good Job

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.