How to build a local exploit database.

How to build a local exploit database.
by d3hydr0 > http://darkcodecracker.blogspot.com/
Date: 03/07/08

In this tutorial I will show you several tools to create
your own local exploit database and how to search through
it. The 2 sites we will be using to gather exploits are
milw0rm and packetstorm. Well, first lets discuss why you
would need a local exploit database. Any answers? Here's mine,
because I can...

There are 3 scripts we will be using to create our database.
The first thing you need to deside is where you want your
exploits stored. Each script has a HOME_DIR option that needs
to be filled out according to your location (unless you like
/home/d3hydr8).

The first script will extract all exploits from packetstorm
from 2000-previous year. First, it will do a time check to
make sure the last year in the YEARS list is the previous year.

Years list:
YEARS = ["00","01","02","03","04","05","06","07"]

This is the first time I have used raw_input in one of my
scripts. It will show you the last year in the list and
the current year. Then ask you if this is correct. Like
shown below:


d3hydr8@linuxbox:~> python packext.py

[+] Checking Years

Last year: 07 Current Year: 08

Is this correct? Yes or No


Here is the c0de and a link:

http://www.darkc0de.com/misc/packext.py


#!/usr/bin/python
#This script will extract all exploits
#from packetstorm from 2000-previous year.

#http://darkc0de.com
#d3hydr8[at]gmail[dot]com

import urllib, tarfile, os, sys, time

HOME_DIR = "/home/d3hydr8/"
YEARS = ["00","01","02","03","04","05","06","07"]

#Time check
now = time.strftime("%Y", time.localtime())[2:]
print "\n[+] Checking Years\n"
if now == YEARS[-1]:
print "[!] The last year in YEARS cannot be the present year.\n"
sys.exit(1)
else:
print "Last year:",YEARS[-1],"Current Year:",now
resp = raw_input("\nIs this correct? Yes or No ").lower()
if resp == "no":
print "\n[!] Modify YEARS list correctly.\n"
sys.exit(1)
elif resp == "yes":
print "\n[+] Starting extraction"
else:
print "\nHUH?\n"
sys.exit(1)

#Make sure HOME_DIR ends with a "/"
if HOME_DIR[-1] != "/":
HOME_DIR = HOME_DIR+"/"
print "[+] Dir:",HOME_DIR,"\n"

#Extraction process
for year in YEARS:
print "Start: 20"+year
try:
os.chdir(HOME_DIR+year+"-exploits")
except(OSError):
os.mkdir(HOME_DIR+year+"-exploits")
os.chdir(HOME_DIR+year+"-exploits")
page = "http://packetstormsecurity.org/"+year+"12-exploits/20"+year+"-exploits.tgz"
urllib.urlretrieve(page, "20"+year+"-exploits.tgz")

tar = tarfile.open("20"+year+"-exploits.tgz")
tar.extractall()
tar.close()

os.remove("20"+year+"-exploits.tgz")
print "Done: 20"+year

print "\n[++] Operation Complete\n"


Here is what you should see when your done:


d3hydr8@linuxbox:~> python packext.py

[+] Checking Years

Last year: 07 Current Year: 08

Is this correct? Yes or No Yes

[+] Starting extraction
[+] Dir: /home/d3hydr8/exploits/

Start: 2000
Done: 2000
Start: 2001
Done: 2001
Start: 2002
Done: 2002
Start: 2003
Done: 2003
Start: 2004
Done: 2004
Start: 2005
Done: 2005
Start: 2006
Done: 2006
Start: 2007
Done: 2007

[++] Operation Complete




Now that we have all of the exploits from packetstorm through the
previous year. Lets use milw0rm to get an archive of remote ports
and platforms.

http://www.darkc0de.com/misc/milarchive.py


#!/usr/bin/python
#Extracts exploit archive for remote
#ports and platforms from milw0rm.

import urllib, tarfile, os

HOME_DIR = "/home/d3hydr8/"

#Make sure HOME_DIR ends with a "/"
if HOME_DIR[-1] != "/":
HOME_DIR = HOME_DIR+"/"
print "\n[+] Dir:",HOME_DIR,"\n"

try:
os.chdir(HOME_DIR)
except(OSError):
os.mkdir(HOME_DIR)
os.chdir(HOME_DIR)
print "[!] Downloading file..."
page = "http://www.milw0rm.com/sploits/milw0rm.tar.bz2"
urllib.urlretrieve(page, "milw0rm.tar.bz2")
print "[!] Extracting files..."
tar = tarfile.open("milw0rm.tar.bz2")
tar.extractall()
tar.close()
os.remove("milw0rm.tar.bz2")
print "\n[!] Operation Complete\n"

#Or
#wget http://www.milw0rm.com/sploits/milw0rm.tar.bz2
#tar -xjvf milw0rm.tar.bz2
#rm milw0rm.tar.bz2
#:)


Output:

What this does is create a milw0rm folder with the
directories platforms and rports.

d3hydr8@linuxbox:~> python milarchive.py

[+] Dir: /home/d3hydr8/exploits/

[!] Downloading file...
[!] Extracting files...

[!] Operation Complete



So, now we have packetstorm, remote port and platforms
but what about webapp exploits? The script below will
help you collect all the webapp exploits from milw0rm.
It will go page by page collecting 30 exploits at a
time and write them to your HOME_DIR+/milw0rm/. The script will
finish when it gets a xplt list length of zero 3x.

Becareful with this tool, set your times accordingly. Milw0rm
does have a DDOS protection with automatic ip blocking.

http://www.darkc0de.com/misc/milwebappext.py


#!/usr/bin/python
#Attempts to collect all webapp
#exploits from milw0rms DB.

import urllib2, time, os, re, urllib

HOME_DIR = "/home/d3hydr8/exploits"
site = "http://www.milw0rm.com/webapps.php?start="
#Time to wait between page loads (in secs)
TIME = "3"

#Make sure HOME_DIR ends with a "/"
if HOME_DIR[-1] != "/":
HOME_DIR = HOME_DIR+"/"
print "\n[+] Dir:",HOME_DIR,"\n"
HOME_DIR = HOME_DIR+"milw0rm/"

try:
os.chdir(HOME_DIR)
except(OSError):
os.mkdir(HOME_DIR)
os.chdir(HOME_DIR)

start = 0
error = 0
while error != 3:
try:
time.sleep(int(TIME))
print "[+] Page:",start
source = urllib2.urlopen(site+str(start), "80").read()
xplts = re.findall("href=\"/exploits/\d+",source)
print "[+] Exploits Found:",len(xplts)
except(urllib2.URLError):
xplt = []
pass
for xplt in xplts:
time.sleep(0.5)
xplt = xplt.replace("href=\"","")
urllib.urlretrieve("http://www.milw0rm.com"+xplt, HOME_DIR+xplt.rsplit("/",1)[1])
if len(xplt) == 0:
error +=1
start +=30
print "\n[!] Operation Complete\n"


Looking more closely at that c0de I'm guessing
you might be able to just change some site info
like exploits >> papers and collect all papers
(or whatever else).

This next script is just a utility for searching
for exploits from the command line from milw0rm.

http://www.darkc0de.com/misc/milsearch.py


#!/usr/bin/python
#Milw0rm exploits search tool.

import urllib2, re, sys

if len(sys.argv) != 2:
print "\nUsage: ./milsearch.py [search]"
print "Ex: ./milsearch.py phpmyadmin\n"
sys.exit(1)

site = "http://www.milw0rm.com/search.php?dong="

try:
source = urllib2.urlopen(site+sys.argv[1], "80").read()
xplts = re.findall("href=\"/exploits/\d+",source)
print "\n[+] Results Found:",len(xplts),"\n"
except(urllib2.URLError):
xplts = []
pass
if len(xplts) >=1:
for xplt in xplts:
xplt = xplt.replace("href=\"","")
print "http://milw0rm.com"+xplt
else:
print "\nNo Results Found\n"


Output:



Now your thinking, "Ok, I have a database of exploits
but how would I keep it up to date?". The script
below will help with this task. It will check milw0rm
for new exploits and download them to your HOME_DIR
if found. The default time is set to check every 5
minutes.

http://www.darkc0de.com/misc/milupdate.py


#!/usr/bin/python
#Checks milw0rm.com for exploit updates.

import urllib2, time, os, re, urllib

HOME_DIR = "/home/d3hydr8/exploits"
site = "http://www.milw0rm.com/"
#Time to wait for update checks (in secs)
TIME = "300"

#Make sure HOME_DIR ends with a "/"
if HOME_DIR[-1] != "/":
HOME_DIR = HOME_DIR+"/"
print "\n[+] Dir:",HOME_DIR,"\n"
HOME_DIR = HOME_DIR+"milw0rm/"

try:
os.chdir(HOME_DIR)
except(OSError):
os.mkdir(HOME_DIR)
os.chdir(HOME_DIR)

done = []
while 1:
time.sleep(int(TIME))
try:
source = urllib2.urlopen(site, "80").readlines()
for line in source:
if re.search("class=\"style15", line):
xplts = re.findall("href=\"/exploits/\d+", line)
except(urllib2.URLError):
xplts = []
pass
if len(xplts) >=1:
for xplt in xplts:
if xplt not in done:
done.append(xplt)
xplt = xplt.replace("href=\"","")
print "[+] Adding: http://www.milw0rm.com"+xplt
urllib.urlretrieve("http://www.milw0rm.com"+xplt, HOME_DIR+xplt.rsplit("/",1)[1])
print "[+] Collected:",len(done),"exploits\n"


If you haven't found an online module to search
through your exploits and bought the domain "exploits4fun.com"
there are a couple ways to search them. The first is use your
GUI search utilty that comes with your os. If using KDE's
Find Files/Folders just change your Name/Location to your
HOME_DIR and use the Contents tab to do the rest.



Or just use your find cmd. I hope this tutorial and tools
were fun. I realize this stuff is pretty much useless when
you could just visit the sites but I had fun writing it. And
remember, because I can...