No open port report in Deepexploit and scan show all ports open about machine_learning_security

[cstayyab]

Facing exact same issue... I even tried to allow all the connections using Windows Firewall on Metasploitable 3. Nmap Scan shows all port open but when nmap is run using proxychains it shows all ports are closed. @matcon can you run nmap using proxychains? Please provide the output of nmap when run with proxychains.

[13o-bbr-bbq]

@matcon
Please show me the all content of the nmap_result_192.168.56.101.xml. .
If XML format of Nmap result has changed, DeepExploit can't extract open ports information.

[hamidb]

I had similar issue. You can modify the code to read nmap output directly from xml file.

[matcon]

this is xml i change to txt for upload here.
nmap_result_192.168.56.101.xml.txt

[cstayyab]

I had similar issue. You can modify the code to read nmap output directly from xml file.

@hamidb can you please send the modified code or tell where exactly to modify?

[qiwihui]

@cstayyab in get_port_list method, just replace nmap_result by nmap_result = open(nmap_result_file, 'rb').read() before using BeautifulSoup

[qiwihui]

@matcon This issue occurred because Msgrpc client failed to read whole nmap result. The cat command show the whole result while just first line was returned from the rpc client. Maybe it is due to there is '\n\n' between first line and the rest of lines.

machine_learning_security/DeepExploit/DeepExploit.py

Lines 888 to 895 in 2fc2558

	nmap_result = ''
	cat_cmd = 'cat ' + nmap_result_file + '\n'
	_ = self.client.call('console.write', [self.client.console_id, cat_cmd])
	time.sleep(3.0)
	time_count = 0
	while True:
	# Judgement of 'services' command finishing.
	ret = self.client.call('console.read', [self.client.console_id])

the ret should return:

{b'data': b'[*] exec: cat nmap_result_192.168.51.2.xml\n\n(and nmap result blabla...)', b'prompt': b'\x01\x02msf5\x01\x02 \x01\x02> ', b'busy': False}

it actually returned:

{b'data': b'[*] exec: cat nmap_result_192.168.51.2.xml\n\n', b'prompt': b'\x01\x02msf5\x01\x02 \x01\x02> ', b'busy': False}

[researchlab17]

Can the fixed portion of the code be uploaded into the main repo?

[cstayyab]

This error is because the Output of any bash command is not returned with the output. There should be a way to do that.

The line [*] exec: cat nmap_result_192.168.51.2.xml\n\n is output from MSFConsole and all the other output of nmap is printed in the bash child process that Msfconsole has open. The output of that child process (bash) is not being included in 'console.read'

[cstayyab]

@cstayyab in get_port_list method, just replace nmap_result by nmap_result = open(nmap_result_file, 'rb').read() before using BeautifulSoup

@qiwihui This solution does not work if Metasploit RPC is on another System in the network and the DeepExploit is running on some other System. Because the path to nmap file will be local but the file would actually exist on the Other System (which has Metasploit and MsgRPC)

[capce]

As mentioned in #49 there were two things to change to get it work for me.

First thing is here:
Replace Line 2226 with nmap_result = os.getcwd() + '/nmap_result_' + env.rhost + '.xml'

machine_learning_security/DeepExploit/DeepExploit.py

Lines 2226 to 2229 in 76a283d

	nmap_result = 'nmap_result_' + env.rhost + '.xml'
	nmap_command = env.nmap_command + ' ' + nmap_result + ' ' + env.rhost + '\n'
	env.execute_nmap(env.rhost, nmap_command, env.nmap_timeout)
	com_port_list, proto_list, info_list = env.get_port_list(nmap_result, env.rhost)

Second thing is:
Insert between line 914 and 915 nmap_result = open(nmap_result_file, 'rb').read() as @qiwihui suggested.

machine_learning_security/DeepExploit/DeepExploit.py

Lines 914 to 915 in 2fc2558

	info_list = []
	bs = BeautifulSoup(nmap_result, 'lxml')

[1939552724]

[!] 302/2006 linux/pop3/cyrus_pop3d_popsubfolders module is danger (rank: normal). Can't load.
[] 303/2006 Loaded exploit: linux/postgres/postgres_payload
[] 304/2006 Loaded exploit: linux/pptp/poptop_negative_read
[] 305/2006 Loaded exploit: linux/proxy/squid_ntlm_authenticate
[] 306/2006 Loaded exploit: linux/redis/redis_replication_cmd_exec
[] 307/2006 Loaded exploit: linux/samba/chain_reply
[] 308/2006 Loaded exploit: linux/samba/is_known_pipename
[] 309/2006 Loaded exploit: linux/samba/lsa_transnames_heap
[!] 310/2006 linux/samba/setinfopolicy_heap module is danger (rank: normal). Can't load.
[] 311/2006 Loaded exploit: linux/samba/trans2open
[!] 312/2006 linux/smtp/apache_james_exec module is danger (rank: normal). Can't load.
[] 313/2006 Loaded exploit: linux/smtp/exim4_dovecot_exec
[] 314/2006 Loaded exploit: linux/smtp/exim_gethostbyname_bof
[!] type:<class 'KeyError'>
[!] args:(b'rank',)
[!] b'rank'
[!] Failed: module.info

Hi, how can I solve the above problem?