rapid7/metasploit-framework — pull request #2541 by wvu-r7 (2013-10-17 21:53:03+00:00)
Title: Outpost24 importer

This is an importer for the Outpost24 log format, specifically for the OUTSCAN and HIAB products. The sample data is private, but if you have access to it, you can verify the importer's behavior against the following output:

```
msf > db_import ../OUTSCAN_Example_All_Vuln_Demo_account_Selected_group.xml
[*] Importing 'Outpost24 XML' data
[*] Import: Parsing with 'Nokogiri v1.6.0'
[*] Importing host 192.168.x.x
[*] Importing host 192.168.y.y
[*] Importing service 192.168.x.x:80/tcp
[*] Importing service 192.168.y.y:22/tcp
[*] Importing service 192.168.y.y:137/udp
[*] Importing service 192.168.y.y:139/tcp
[*] Importing service 192.168.y.y:445/tcp
[*] Importing service 192.168.y.y:8009/tcp
[*] Importing service 192.168.y.y:8080/tcp
[*] Importing vulnerability 'SQL Injection (192.168.x.x)' (1 instance)
[*] Importing vulnerability 'Reflected Cross-Site Scripting (192.168.x.x)' (1 instance)
[*] Importing vulnerability 'Samba: Filename-base Format String Bug (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'Samba: smbd *trans* Request Arbitrary Remote Memory Disclosure (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'SMB Null Sessions Enabled (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'Anonymous SMB Login Enabled (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'Samba Root Filesystem Access Vulnerability (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'Samba: POSIX Access Control Override (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'ICMP Timestamp Request (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'SSH Banner (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'HTTP Detection (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'NetBIOS Name Enumeration (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'SMB Native LanMan Information (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'SMB Login (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'SMB Network Share Enumeration (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'SMB Host Security Identifier (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'Traceroute (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'SSH Supported Authentication Mechanisms (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'SSH Supported Protocol Versions (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'TCP SYN|FIN (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'HTTP Information (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'HTTP Options Supported (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'SMB Host SID Local User Enumeration (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'SMB LanMan Pipe Server Browsing (192.168.y.y)' (1 instance)
[*] Importing vulnerability 'SMB Host Password Policy (192.168.y.y)' (1 instance)
[*] Successfully imported /home/wvu/OUTSCAN_Example_All_Vuln_Demo_account_Selected_group.xml
msf > hosts

Hosts
=====

address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- --------
192.168.x.x web.example.com Unknown device OUTSCAN Security Report
192.168.y.y intra.example.com Unknown device OUTSCAN Security Report

msf > services

Services
========

host port proto name state info
---- ---- ----- ---- ----- ----
192.168.x.x 80 tcp http open OUTSCAN Security Report
192.168.y.y 139 tcp netbios-ssn open OUTSCAN Security Report
192.168.y.y 137 udp netbios-ns open OUTSCAN Security Report
192.168.y.y 22 tcp ssh open OUTSCAN Security Report
192.168.y.y 445 tcp netbios-ssn open OUTSCAN Security Report
192.168.y.y 8009 tcp ajp open OUTSCAN Security Report
192.168.y.y 8080 tcp http open OUTSCAN Security Report

msf > vulns -i
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.x.x name=SQL Injection refs= info=The application dynamically generates an SQL query based on user input, but it does not sufficiently prevent that input from modifying the intended structure of the query.

Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. This can be used to alter query logic to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands.

SQL injection has become a common issue with database-driven web sites. The flaw is easily detected, and easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.x.x name=Reflected Cross-Site Scripting refs= info=The software does not sufficiently validate, filter, escape, and encode user-controllable input before it is placed in output that is used as a web page that is served to other users.

The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a user to supply dangerous content to a vulnerable web application, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces victims to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the user, the content is executed and proceeds to transfer private information, such as cookies that may include session information, from the user's machine to the attacker or perform other nefarious activities.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=Samba: Filename-base Format String Bug refs=CVE-2009-1886 info=Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=Samba: smbd *trans* Request Arbitrary Remote Memory Disclosure refs=CVE-2008-4314 info=smbd in Samba might allow remote attackers to read arbitrary memory and cause a denial of service via crafted (1) trans, (2) trans2, and (3) nttrans requests, related to a "cut&paste error" that causes an improper bounds check to be performed.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=SMB Null Sessions Enabled refs=CVE-1999-0519 info=This SMB service accepts anonymous connections in the form of Null sessions. If this is an internet facing server, having anonymous access to it is generally a bad idea.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=Anonymous SMB Login Enabled refs= info=Anonymous access to this SMB service is enabled. If this is an internet-facing server, having anonymous access to it is generally a bad idea.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=Samba Root Filesystem Access Vulnerability refs=CVE-2009-0022 info=Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted connection request that specifies a blank share name.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=Samba: POSIX Access Control Override refs=CVE-2009-1888 info=The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=ICMP Timestamp Request refs=CVE-1999-0524 info=The remote host replies to ICMP Timestamp requests.

Knowing the exact time on your system may help an attacker
to break time-based authentication systems.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=SSH Banner refs= info=The SSH server banner:
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=HTTP Detection refs= info=An HTTP server was found running on the remote host.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=NetBIOS Name Enumeration refs=CVE-1999-0621 info=A NetBIOS service replies to queries on udp port 137.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=SMB Native LanMan Information refs= info=Sending an authentication request to this host reveals the following
information:
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=SMB Login refs= info=This check attempts to login to the remote SMB service.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=SMB Network Share Enumeration refs= info=SMB shares available on this host:
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=SMB Host Security Identifier refs=CVE-2000-1200 info=It was possible to get the host Security Indentifier (SID) through the
SMB service, by calling LsaQueryInformationPolicy. This can be used to
enumerate local user accounts.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=Traceroute refs= info=This check tries to determine the path; traceroute, between our attacker
and your target host. This path may give an attacker valuable information about
through which routers; hops, traffic passes through. This is not a
vulnerability in itself it is merely considered information, however, an
attacker could possibly use this information to determine what ISP you have and
so forth.

Note:
The path is not static and will most likely change depending on from which host
you perform the traceroute. There is also no way you can fix this problem as it
involves changing configurations on all the hops along the way.
[*] Time: 2013-10-17 21:49:40 UTC Vuln: host=192.168.y.y name=SSH Supported Authentication Mechanisms refs= info=The SSH service running on this port supports the following authentication
mechanisms.
[*] Time: 2013-10-17 21:49:41 UTC Vuln: host=192.168.y.y name=SSH Supported Protocol Versions refs= info=The remote host is running a version of the SSH protocol. OUTSCAN has
detected that the following is true for the remote host.
[*] Time: 2013-10-17 21:49:41 UTC Vuln: host=192.168.y.y name=TCP SYN|FIN refs= info=The TCP implementation on this host replies to invalid TCP packets.
Packets with both the SYN and the FIN bit set are considered invalid
and should be discarded.

Not doing so could have a negative impact on IDS systems. Depending on
the order in which the flag-bits are parsed, the TCP implementation
of this host's operating system may see the SYN bit first and initiate
a connection while the TCP implementation of the IDS parses the FIN bit
first, making it believe that the connection has just been closed.

Effectively, this could mean that a connection can be established without
the IDS keeping track of it.
[*] Time: 2013-10-17 21:49:41 UTC Vuln: host=192.168.y.y name=HTTP Information refs= info=HTTP Server Information
[*] Time: 2013-10-17 21:49:41 UTC Vuln: host=192.168.y.y name=HTTP Options Supported refs= info=The following options are supported by the web server running on this port.
[*] Time: 2013-10-17 21:49:41 UTC Vuln: host=192.168.y.y name=SMB LanMan Pipe Server Browsing refs= info=This host will reveal the list of other nearby Windows systems
when queried through the LanMan pipe.
[*] Time: 2013-10-17 21:49:41 UTC Vuln: host=192.168.y.y name=SMB Host Password Policy refs= info=The remote host has a password policy set. This password policy must
conform to the International System Policy.
msf >
```

There are changes to lib/msf/core/db.rb, so please be careful with this PR and check with the Pro team.