-2

I would like to know if in metasploit for any given exploit its possible to use a target list instead of a single target and if possible how is that done?

closed as off-topic by ThoriumBR, multithr3at3d, MechMK1, Jeroen, Graham Hill Aug 12 at 13:54

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – ThoriumBR, multithr3at3d, MechMK1, Jeroen
If this question can be reworded to fit the rules in the help center, please edit the question.

2

Traditionally, this worked for non-exploits using RHOSTS:

Scanners and most other auxiliary modules use the ‘RHOSTS’ option instead of ‘RHOST’. RHOSTS can take IP ranges (192.168.1.20-192.168.1.30), CIDR ranges (192.168.1.0/24), multiple ranges separated by commas (192.168.1.0/24, 192.168.3.0/24), and line-separated host list files (file:/tmp/hostlist.txt).

Recent work extended RHOSTS usage to include exploits, as well:

msf5 exploit(linux/ssh/symantec_smg_ssh) > set RHOSTS 172.16.185.218, 172.16.231.122
RHOSTS => 172.16.185.218, 172.16.231.122
msf5 exploit(linux/ssh/symantec_smg_ssh) > run
[*] Exploiting target 172.16.185.218

[*] 172.16.185.218:22 - Attempt to login...
[-] 172.16.185.218:22 SSH - Failed authentication
[*] Exploiting target 172.16.231.122
[*] 172.16.231.122:22 - Attempt to login...
[-] 172.16.231.122:22 SSH - Failed authentication
[*] Exploit completed, but no session was created.
msf5 exploit(linux/ssh/symantec_smg_ssh) 

This also works with files as described:

$ cat /tmp/hostlist.txt
172.16.185.218
172.16.231.122
$ fg
msfconsole

msf5 exploit(linux/ssh/symantec_smg_ssh) > set RHOSTS file:/tmp/hostlist.txt
RHOSTS => file:/tmp/hostlist.txt
msf5 exploit(linux/ssh/symantec_smg_ssh) > run
[*] Exploiting target 172.16.185.218

[*] 172.16.185.218:22 - Attempt to login...
[-] 172.16.185.218:22 SSH - Failed authentication
[*] Exploiting target 172.16.231.122
[*] 172.16.231.122:22 - Attempt to login...
[-] 172.16.231.122:22 SSH - Failed authentication
[*] Exploit completed, but no session was created.
msf5 exploit(linux/ssh/symantec_smg_ssh) 

Not the answer you're looking for? Browse other questions tagged or ask your own question.