Current ThreatQ Version Filter
 

Metasploit Exploit CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

Metasploit is a very popular exploitation framework for building and executing exploits against known vulnerabilities. This feed consumes data from the public Metasploit code repository on Github about exploits published and available in the framework. The feed identifies the CVEs (where referenced) and can therefore be used for vulnerability prioritization. It is updated frequently and the recommended poll period for the source is daily.

Installation

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

  1. Navigate to your integrations management page in ThreatQ.
  2. Select the OSINT option from the Category dropdown (optional).

    If you are installing the integration for the first time, it will be located under the Disabled tab.

  3. Click on the integration entry to open its details page.
  4. Enter the following parameter under the Configuration tab:
    Parameter Description
    Verify Host SSL If checked, validates the server's certificate and checks whether the server's hostname matches. This parameter is enabled by default.
  5. Review any additional settings, make any changes if needed, and click on Save.
  6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

Metasploit Exploits

Sample Response:

{
    "auxiliary_admin/2wire/xslt_password_reset": {
        "name": "2Wire Cross-Site Request Forgery Password Reset Vulnerability",
        "fullname": "auxiliary/admin/2wire/xslt_password_reset",
        "aliases": [],
        "rank": 300,
        "disclosure_date": "2007-08-15",
        "type": "auxiliary",
        "author": ["hkm <hkm@hakim.ws>", "Travis Phillips"],
        "description": "This module will reset the admin password on a 2Wire wireless router.  This is\n        done by using the /xslt page where authentication is not required, thus allowing\n        configuration changes (such as resetting the password) as administrators.",
        "references": [
            "CVE-2007-4387",
            "OSVDB-37667",
            "BID-36075",
            "URL-https://seclists.org/bugtraq/2007/Aug/225"
        ],
        "platform": "",
        "arch": "",
        "rport": 80,
        "autofilter_ports": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443],
        "autofilter_services": ["http", "https"],
        "targets": null,
        "mod_time": "2018-09-15 18:54:45 +0000",
        "path": "/modules/auxiliary/admin/2wire/xslt_password_reset.rb",
        "is_install_path": true,
        "ref_name": "admin/2wire/xslt_password_reset",
        "check": false,
        "post_auth": false,
        "default_credential": false,
        "notes": {}
    }
}

ThreatQuotient provides the following default mapping for this feed:

Feed Data Path ThreatQ Entity ThreatQ Object Type or Attribute Key Published Date Examples Notes
.name malware.value N/A .mod_time 2Wire Cross-Site Request Forgery Password Reset Vulnerability  
.description malware.description N/A .mod_time This module will reset the admin password on a 2Wire... Mapped after some processing
N/A malware.attribute Type .mod_time Exploit Hard coded
.references malware.attribute Reference URL .mod_time https://seclists.org/bugtraq/2007/Aug/225 Only if value starts with URL-
.references malware.attribute Reference .mod_time BID-36075 Excludes URL, CVE, and CWE refs
.references malware.attribute Disclosure Date .mod_time 2007-08-15  
.author malware.attribute Author .mod_time Travis Phillips  
.references vulnerability.value N/A .mod_time CVE-2007-4387 Only if value starts with CVE-
.references vulnerability.value N/A .mod_time CWE-12345 Only if value starts with CWE-
N/A vulnerability.attribute Exploit Exists .mod_time True Hard coded
N/A vulnerability.attribute Exploit in Metasploit .mod_time True Hard coded
.references indicator.value CVE .mod_time CVE-2007-4387 Only if value starts with CVE-
N/A indicator.attribute Exploit Exists .mod_time True Hard coded
N/A indicator.attribute Exploit in Metasploit .mod_time True Hard coded

Change Log

  • Version 1.0.0
    • Initial release

PDF Guides

Document ThreatQ Version
Metasploit Exploits CDF Guide v1.0.0 4.22.0 or Greater