mosquito

Mosquito - Update v:7.17.4

Project Referencies

[1] Project home page
[2] Framework Description
[3] Framework download (mosquito)
[4] hacking-material-books - metasploit_resource_files
[5] mass_exploiter.rc - module develop (public contributions)

UPDATED - NEW	COMMAND	DESCRIPTION
mosquito.sh	exploit	Armitage Hail Mary (based) rc script (menu option)
install.sh	mosquito.sh -u	Download/Install mass_exploiter.rc script (new)
mass_exploiter.rc		Armitage Hail Mary (based) resource script (new) *
http-proxy-brute.py		HTTP basic (cookie) authentication brute force (new) **
brute_force.rc	2	added rpc/msrpc service port (55553) to brute_force.rc
ms17_010.rc	3	RHOSTS multiple ports sellection bugfix (ports: 135:139)
rtsp-url-brute.rc	14	added function 'Google Dork seach for webcams?'
all rc scripts		Nmap/Metasploit scan/brute-force timeout(s) improved
all rc scripts		Geolocation of alive RHOST(s) found (public ip addr) ***
all rc scripts		upgrade command Shell (session) to Meterpreter ?
all rc scripts		added 'Suggest exploits based on CVE id numbers' ?
all rc scripts		Credentials found displays in 'services' report notes

* mass_exploiter.rc script can be used outside mosquito framework (msf & nmap dependencies)
** http-proxy-brute.py its written when using mass_exploiter.rc <setg MAX_PORTS true> module
*** The Geo-Location Function (all rc scripts) will NOT geolocate Internal IP adrress(s)

---

all rc scripts - Geolocation of RHOSTS in 'services' report notes

all rc scripts - Suggest exploits based on CVE id numbers found

all rc scripts - Credentials found displays in 'sessions' report notes

---

rtsp-url-brute.rc - Google Dork seach for webcams?

---

mass_exploiter.rc - armitage Hail Mary (based) resource script

mass_exploiter.rc resource script allow us to scan user inputs (rhosts/lhosts) or import an database.xml file to msfdb and auto-run multiple exploit modules againts all alive db hosts based on their port number(s) or service name(s). 'This module will try to exploit open port(s): 21:22:23:80:110:445:1433:3306 (default scans) and ports: 21:22:23:80:110:139:445:1433:3306:3389:8080:55553 in MAX_PORTS (global variable) mode.

mass_exploiter.rc - module available options (Global Variables)

mass_exploiter.rc - exploit suggester (dont exploit)

mass_exploiter.rc - manually sellecting www.facebook.com as 2º decoy ip addr

mass_exploiter.rc - Scans performed using a fake UserAgent string (Apple)

mass_exploiter.rc - multi tasking RHOSTS (two targets) scans on port 21 (ftp)

mass_exploiter.rc - brute force basic cookie authentication

mass_exploiter.rc - upgrade shell command (session) to meterpreter?

For those occasions were we have a service/exploit shell but we are more familiarized with meterpreter.

REMARK: Some type of shells can NOT be upgraded to meterpreter ..

---

List of metasploit auxiliary/exploit modules used by mass_exploiter:

Total Modules Count: [57] modules
Total Modules Load: [46] exploits [11] scanners modules (MAX_PORTS)

MODULE NAME	PORT Nº	SERVICE NAME	EXECUTION
auxiliary/scanner/ftp/ftp_version	21	FTP	DEFAULT
exploit/unix/ftp/proftpd_modcopy_exec	21	FTP	DEFAULT
exploit/multi/ftp/pureftpd_bash_env_exec	21	FTP	DEFAULT
exploit/windows/ftp/ms09_053_ftpd_nlst	21	FTP	DEFAULT
exploit/windows/ftp/freefloatftp_wbem	21	FTP	DEFAULT
exploit/unix/ftp/vsftpd_234_backdoor	21	FTP	DEFAULT
exploit/linux/ftp/proftp_telnet_iac	21	FTP	DEFAULT
auxiliary/scanner/ssh/ssh_version	22	SSH	DEFAULT
scanner/ssh/eaton_xpert_backdoor	22	SSH	DEFAULT
auxiliary/scanner/ssh/libssh_auth_bypass	22	SSH	DEFAULT
exploit/windows/ssh/freesshd_authbypass	22	SSH	DEFAULT
exploit/apple_ios/ssh/cydia_default_ssh	22	SSH	DEFAULT
exploit/windows/ssh/sysax_ssh_username	22	SSH	DEFAULT
exploit/windows/ssh/freeftpd_key_exchange	22	SSH	DEFAULT
auxiliary/scanner/telnet/telnet_version	23	TELNET	DEFAULT
unix/misc/polycom_hdx_traceroute_exec	23	TELNET	DEFAULT
exploit/windows/telnet/gamsoft_telsrv_username	23	TELNET	DEFAULT
exploit/linux/telnet/netgear_telnetenable	23	TELNET	DEFAULT
auxiliary/scanner/http/http_header	80	HTTP	DEFAULT
exploit/multi/http/zpanel_information_disclosure_rce	80	HTTP	DEFAULT
exploit/windows/http/ektron_xslt_exec_ws	80	HTTP	DEFAULT
exploit/windows/http/dup_scout_enterprise_login_bof	80	HTTP	DEFAULT
exploit/windows/http/rejetto_hfs_exec	80	HTTP	DEFAULT
auxiliary/scanner/http/http_login	80	HTTP	DEFAULT
exploit/windows/http/easyfilesharing_seh	80	HTTP	DEFAULT
exploit/multi/http/getsimplecms_unauth_code_exec	80	HTTP	DEFAULT
auxiliary/scanner/pop3/pop3_version	110	POP3	DEFAULT
exploit/linux/pop3/cyrus_pop3d_popsubfolders	110	POP3	DEFAULT
exploit/windows/pop3/seattlelab_pass	110	POP3	DEFAULT
exploit/multi/samba/usermap_script	139	NETBIOS-SSN	MAX_PORTS
exploit/windows/smb/ms08_067_netapi	139	NETBIOS-SSN	MAX_PORTS
exploit/multi/ids/snort_dce_rpc	139	NETBIOS-SSN	MAX_PORTS
auxiliary/scanner/smb/smb_version	445	SMB	DEFAULT
auxiliary/scanner/smb/smb_ms17_010	445	SMB	DEFAULT
exploit/windows/smb/ms06_066_nwapi	445	SMB	DEFAULT
exploit/windows/smb/webexec	445	SMB	DEFAULT
exploit/windows/smb/ms08_067_netapi	445	SMB	DEFAULT
exploit/windows/smb/ms17_010_psexec	445	SMB	DEFAULT
exploit/windows/smb/ms17_010_eternalblue	445	SMB	DEFAULT
exploit/windows/smb/ms09_050_smb2_negotiate_func_index	445	SMB	DEFAULT
exploit/windows/smb/ms10_061_spoolss	445	SMB	DEFAULT
auxiliary/scanner/mssql/mssql_ping	1433	MSSQL	DEFAULT
exploit/windows/mssql/mssql_clr_payload	1433	MSSQL	DEFAULT
exploit/windows/mssql/mssql_payload	1433	MSSQL	DEFAULT
auxiliary/scanner/mysql/mysql_version	3306	MYSQL	DEFAULT
exploit/multi/mysql/mysql_udf_payload	3306	MYSQL	DEFAULT
exploit/windows/mysql/mysql_yassl_hello	3306	MYSQL	DEFAULT
exploit/windows/mysql/scrutinizer_upload_exec	3306	MYSQL	DEFAULT
auxiliary/scanner/rdp/ms12_020_check	3389	RDP	MAX_PORTS
auxiliary/scanner/rdp/cve_2019_0708_bluekeep	3389	RDP	MAX_PORTS
auxiliary/dos/windows/rdp/ms12_020_maxchannelids	3389	RDP	MAX_PORTS
auxiliary/dos/rdp/cve_2019_0708_bluekeep_dos	3389	RDP	MAX_PORTS
exploit/windows/http/tomcat_cgi_cmdlineargs	8080	HTTP-PROXY	MAX_PORTS
exploit/multi/http/tomcat_jsp_upload_bypass	8080	HTTP-PROXY	MAX_PORTS
exploit/multi/http/struts2_namespace_ognl	8080	HTTP-PROXY	MAX_PORTS
http-proxy-brute.py	8080	HTTP-PROXY	MAX_PORTS
auxiliary/scanner/msf/msf_rpc_login	55553	MSRPC	MAX_PORTS

---

Framework update (local version -> remote version)

If we already have an mosquito old version installed, then we just need to run: ./mosquito.sh -u
to update curent installation. (note: git clone download/install method its more stable that the update function)

sudo ./mosquito.sh -u

---

Framework Download (full download)

Delete old project folder

rm -rf resource_files

Framework Download

git clone https://github.com/r00t-3xp10it/resource_files.git
cd resource_files && find ./ -name "*.sh" -exec chmod +x {} \;

Framework help

sudo ./mosquito.sh -h

Framework install (fist time-run)

sudo ./mosquito.sh -i

Framework execution

sudo ./mosquito.sh

---

Project Acknowledgments

@fyodor - nmap framework
@hdm - metasploit framework
@GMedian - vulners.nse script
@seanwarnock - http-winrm.nse script
@mathiasgut - freevulnsearch.nse script
@patrikkarlsson - rtsp-url-brute.nse script

Suspicious Shell Activity redteam@2019