Is it possible to automatically search the Metasploit database for usable exploits based on information about the vulnerabilities on the hosts?
Searching in Metasploit for each CVE number to see if there is an exploit available can be quite tedious, so can this be automated in any way? I have filled my Metasploit database with vulnerabilities from OpenVAS, but can I automate the searching for exploits in some way?
This functionality is mainly what can be expected by most vulnerability scanners. For one but Nexpose and Nessus automatically say if a Metasploit exploit is available and what name it is.
There is a plugin available here on github, which could do what you want given some modification in regards to openVAS integration. This plugin does auto-exploitation against a vulnerability scanner's imported DB.
Is Hail Mary what you are looking for?
It's like a smarter db_autopwn. Hail Mary finds recommended exploits for your targets, filters them using the OS info of your target, and then sorts the exploits into an optimal order. These exploits are then launched as one big volley at your target.
Or maybe the more familiar Autopwn ?
After identifying a victim's machine using port scanning techniques,Just run the Metasploit framework and connect to sqlite database.Again run a port scan on victim's machine so that the result is saved in the database.Then run the Autopwn tool against the port scan result,Autopwn will automatically run all the exploits against the open port.When the attack completes successfully, we get open sessions. Job Done! BTW, This can also be achieved by running Autopwn exploits against the result saved by Nessus in NBE format.
