Multiplatform Installed Software Version Enumerator - Metasploit
This page contains detailed information about how to use the post/multi/gather/enum_software_versions metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.
Module Overview
Name: Multiplatform Installed Software Version Enumerator
Module: post/multi/gather/enum_software_versions
Source code: modules/post/multi/gather/enum_software_versions.rb
Disclosure date: -
Last modification time: 2021-02-16 13:56:50 +0000
Supported architecture(s): -
Supported platform(s): Android, BSD, Linux, OSX, Solaris, Windows
Target service / protocol: -
Target network port(s): -
List of CVEs: -
This module, when run against a compromised machine, will gather details on all installed software, including their versions and if available, when they were installed, and will save it into a loot file for later use. Users can then use this loot file to determine what additional vulnerabilites may affect the target machine. Note that for Linux systems, software enumeration is done via package managers. As a result the results may not reflect all of the available software on the system simply because users may have installed additional software from alternative sources such as source code that these package managers are not aware of.
Module Ranking and Traits
Module Ranking:
- normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.
Basic Usage
There are two ways to execute this post module.
From the Meterpreter prompt
The first is by using the "run" command at the Meterpreter prompt. It allows you to run the post module against that specific session:
meterpreter > run post/multi/gather/enum_software_versions
From the msf prompt
The second is by using the "use" command at the msf prompt. You will have to figure out which session ID to set manually. To list all session IDs, you can use the "sessions" command.
msf > use post/multi/gather/enum_software_versions
msf post(enum_software_versions) > show options
... show and set options ...
msf post(enum_software_versions) > set SESSION session-id
msf post(enum_software_versions) > exploit
If you wish to run the post against all sessions from framework, here is how:
1 - Create the following resource script:
framework.sessions.each_pair do |sid, session|
run_single("use post/multi/gather/enum_software_versions")
run_single("set SESSION #{sid}")
run_single("run")
end
2 - At the msf prompt, execute the above resource script:
msf > resource path-to-resource-script
Required Options
- SESSION: The session to run this module on.
Knowledge Base
Vulnerable Application
This module uses an existing session on any Windows, Linux, BSD, Solaris, OSX or Android machine to gather information about all software installed on the target machine and their versions.
This module therefore targets any machine running Windows, Linux, BSD, Solaris, OSX, or Android. Note that for Linux systems, software enumeration is done via package managers. As a result the results may not reflect all of the available software on the system simply because users may have installed additional software from alternative sources such as source code that these package managers are not aware of.
Verification Steps
- Get session
- Do
use post/multi/gather/enum_software_versions
- Do
set SESSION <session id>
- Do
run
- See loot.
Options
This module does not use any special options beyond the standard SESSION
option which
is set to the value of the session the user wishes to run this module on.
Scenarios
Windows Server 2019 Standard Edition x64 Running as a Low Privileged User
msf6 exploit(multi/handler) > use post/multi/gather/enum_software_versions
msf6 post(multi/gather/enum_software_versions) > show options
Module options (post/multi/gather/enum_software_versions):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
msf6 post(multi/gather/enum_software_versions) > set SESSION 1
SESSION => 1
msf6 post(multi/gather/enum_software_versions) > run
[+] Stored information about the installed products to the loot file at /home/gwillcox/.msf4/loot/20200915173649_default_172.27.37.216_host.windows.sof_930739.txt
[*] Post module execution completed
msf6 post(multi/gather/enum_software_versions) > cat /home/gwillcox/.msf4/loot/20200915173649_default_172.27.37.216_host.windows.sof_930739.txt
[*] exec: cat /home/gwillcox/.msf4/loot/20200915173649_default_172.27.37.216_host.windows.sof_930739.txt
Description InstallDate Name Version
Pragma TelnetServer 20200911 Pragma TelnetServer 7.0.10.1990
Google Update Helper 20200910 Google Update Helper 1.3.35.451
VanDyke Software SecureCRT 8.7 20200911 VanDyke Software SecureCRT 8.7 8.7.3
msf6 post(multi/gather/enum_software_versions) >
Go back to menu.
Msfconsole Usage
Here is how the multi/gather/enum_software_versions post exploitation module looks in the msfconsole:
msf6 > use post/multi/gather/enum_software_versions
msf6 post(multi/gather/enum_software_versions) > show info
Name: Multiplatform Installed Software Version Enumerator
Module: post/multi/gather/enum_software_versions
Platform: Windows, Linux, OSX, BSD, Solaris, Android
Arch:
Rank: Normal
Provided by:
gwillcox-r7
Compatible session types:
Meterpreter
Shell
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Description:
This module, when run against a compromised machine, will gather
details on all installed software, including their versions and if
available, when they were installed, and will save it into a loot
file for later use. Users can then use this loot file to determine
what additional vulnerabilites may affect the target machine. Note
that for Linux systems, software enumeration is done via package
managers. As a result the results may not reflect all of the
available software on the system simply because users may have
installed additional software from alternative sources such as
source code that these package managers are not aware of.
Module Options
This is a complete list of options available in the multi/gather/enum_software_versions post exploitation module:
msf6 post(multi/gather/enum_software_versions) > show options
Module options (post/multi/gather/enum_software_versions):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Advanced Options
Here is a complete list of advanced options supported by the multi/gather/enum_software_versions post exploitation module:
msf6 post(multi/gather/enum_software_versions) > show advanced
Module advanced options (post/multi/gather/enum_software_versions):
Name Current Setting Required Description
---- --------------- -------- -----------
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
Post Actions
This is a list of all post exploitation actions which the multi/gather/enum_software_versions module can do:
msf6 post(multi/gather/enum_software_versions) > show actions
Post actions:
Name Description
---- -----------
Evasion Options
Here is the full list of possible evasion options supported by the multi/gather/enum_software_versions post exploitation module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):
msf6 post(multi/gather/enum_software_versions) > show evasion
Module evasion options:
Name Current Setting Required Description
---- --------------- -------- -----------
Go back to menu.
Error Messages
This module may fail with the following error messages:
- The command 'pm' does not exist on the host
- No results were returned when trying to get software installed on the Linux host. An error likely occured.
- The 'wmic' command doesn't exist on this host!
- Was unable to get a listing of installed products...
- The target system either doesn't have a package manager system, or does not use a known package manager system!
- Unable to enumerate the software on the target system. Exiting...
- The command <CMD:0> was not found on the target.
- No results were returned when trying to get software installed on the Linux host. An error likely occured.
- The command 'pkg' does not exist on the host
- No results were returned when trying to get software installed on the BSD/Solaris host. An error likely occured.
- The command 'system_profiler' does not exist on the host! Something is seriously wrong!
- No results were returned when trying to get software installed on the OSX host via system_profiler!
- Something is odd with this Android device. You are root but the dumpsys command doesn't exist. Perhaps the device is too old?
- Something went wrong with the command and no output was returned!
- You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed.
- You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed.
Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.
The command 'pm' does not exist on the host
Here is a relevant code snippet related to the "The command 'pm' does not exist on the host" error message:
33: print_good("Stored information about the installed products to the loot file at #{file}")
34: end
35:
36: def enumerate_android_packages
37: if command_exists?('pm') == false
38: print_error("The command 'pm' does not exist on the host")
39: return nil
40: end
41: listing = cmd_exec('pm list packages -f').to_s
42: if listing.empty?
43: print_error('No results were returned when trying to get software installed on the Linux host. An error likely occured.')
No results were returned when trying to get software installed on the Linux host. An error likely occured.
Here is a relevant code snippet related to the "No results were returned when trying to get software installed on the Linux host. An error likely occured." error message:
38: print_error("The command 'pm' does not exist on the host")
39: return nil
40: end
41: listing = cmd_exec('pm list packages -f').to_s
42: if listing.empty?
43: print_error('No results were returned when trying to get software installed on the Linux host. An error likely occured.')
44: return nil
45: end
46: listing
47: end
48:
The 'wmic' command doesn't exist on this host!
Here is a relevant code snippet related to the "The 'wmic' command doesn't exist on this host!" error message:
49: # Run Method for when run command is issued
50: def run
51: case session.platform
52: when 'windows'
53: if command_exists?('wmic') == false
54: print_error("The 'wmic' command doesn't exist on this host!") # wmic is technically marked as depreciated so this command could very well be removed in future releases.
55: return
56: end
57: listing = cmd_exec('wmic product get Name, Description, Version, InstallDate', nil, 6000).to_s
58: unless listing.include?('Description')
59: print_error('Was unable to get a listing of installed products...')
Was unable to get a listing of installed products...
Here is a relevant code snippet related to the "Was unable to get a listing of installed products..." error message:
54: print_error("The 'wmic' command doesn't exist on this host!") # wmic is technically marked as depreciated so this command could very well be removed in future releases.
55: return
56: end
57: listing = cmd_exec('wmic product get Name, Description, Version, InstallDate', nil, 6000).to_s
58: unless listing.include?('Description')
59: print_error('Was unable to get a listing of installed products...')
60: return
61: end
62: file = store_loot('host.windows.software.versions', 'text/plain', session, listing, 'installed_software.txt', 'Installed Software and Versions')
63: print_good("Stored information about the installed products to the loot file at #{file}")
64: when 'linux'
The target system either doesn't have a package manager system, or does not use a known package manager system!
Here is a relevant code snippet related to the "The target system either doesn't have a package manager system, or does not use a known package manager system!" error message:
83: elsif command_exists?('equo') # Sabayon
84: cmd = %w[equo q list installed -v]
85: elsif command_exists?('nix-env')
86: cmd = %w[nix-env -q]
87: else
88: print_error("The target system either doesn't have a package manager system, or does not use a known package manager system!")
89: print_error('Unable to enumerate the software on the target system. Exiting...')
90: return nil
91: end
92:
93: if command_exists?((cmd[0]).to_s) == false
Unable to enumerate the software on the target system. Exiting...
Here is a relevant code snippet related to the "Unable to enumerate the software on the target system. Exiting..." error message:
84: cmd = %w[equo q list installed -v]
85: elsif command_exists?('nix-env')
86: cmd = %w[nix-env -q]
87: else
88: print_error("The target system either doesn't have a package manager system, or does not use a known package manager system!")
89: print_error('Unable to enumerate the software on the target system. Exiting...')
90: return nil
91: end
92:
93: if command_exists?((cmd[0]).to_s) == false
94: print_error("The command #{cmd[0]} was not found on the target.")
The command <CMD:0> was not found on the target.
Here is a relevant code snippet related to the "The command <CMD:0> was not found on the target." error message:
89: print_error('Unable to enumerate the software on the target system. Exiting...')
90: return nil
91: end
92:
93: if command_exists?((cmd[0]).to_s) == false
94: print_error("The command #{cmd[0]} was not found on the target.")
95: return
96: else
97: listing = cmd_exec(cmd.join(' ')).to_s
98: if listing.empty?
99: print_error('No results were returned when trying to get software installed on the Linux host. An error likely occured.')
No results were returned when trying to get software installed on the Linux host. An error likely occured.
Here is a relevant code snippet related to the "No results were returned when trying to get software installed on the Linux host. An error likely occured." error message:
94: print_error("The command #{cmd[0]} was not found on the target.")
95: return
96: else
97: listing = cmd_exec(cmd.join(' ')).to_s
98: if listing.empty?
99: print_error('No results were returned when trying to get software installed on the Linux host. An error likely occured.')
100: return
101: end
102: store_linux_loot(listing)
103: end
104: when 'bsd', 'solaris'
The command 'pkg' does not exist on the host
Here is a relevant code snippet related to the "The command 'pkg' does not exist on the host" error message:
101: end
102: store_linux_loot(listing)
103: end
104: when 'bsd', 'solaris'
105: if command_exists?('pkg') == false
106: print_error("The command 'pkg' does not exist on the host")
107: return
108: end
109: listing = cmd_exec('pkg info').to_s
110: if listing.empty?
111: print_error('No results were returned when trying to get software installed on the BSD/Solaris host. An error likely occured.')
No results were returned when trying to get software installed on the BSD/Solaris host. An error likely occured.
Here is a relevant code snippet related to the "No results were returned when trying to get software installed on the BSD/Solaris host. An error likely occured." error message:
106: print_error("The command 'pkg' does not exist on the host")
107: return
108: end
109: listing = cmd_exec('pkg info').to_s
110: if listing.empty?
111: print_error('No results were returned when trying to get software installed on the BSD/Solaris host. An error likely occured.')
112: return
113: end
114: file = store_loot('host.bsd.solaris.software.versions', 'text/plain', session, listing, 'installed_software.txt', 'Installed Software and Versions')
115: print_good("Stored information about the installed products to the loot file at #{file}")
116: when 'osx'
The command 'system_profiler' does not exist on the host! Something is seriously wrong!
Here is a relevant code snippet related to the "The command 'system_profiler' does not exist on the host! Something is seriously wrong!" error message:
114: file = store_loot('host.bsd.solaris.software.versions', 'text/plain', session, listing, 'installed_software.txt', 'Installed Software and Versions')
115: print_good("Stored information about the installed products to the loot file at #{file}")
116: when 'osx'
117: listing = ''
118: if command_exists?('system_profiler') == false
119: print_error("The command 'system_profiler' does not exist on the host! Something is seriously wrong!")
120: return
121: end
122: command_result = cmd_exec('system_profiler SPApplicationsDataType').to_s
123: if command_result.empty?
124: print_error('No results were returned when trying to get software installed on the OSX host via system_profiler!')
No results were returned when trying to get software installed on the OSX host via system_profiler!
Here is a relevant code snippet related to the "No results were returned when trying to get software installed on the OSX host via system_profiler!" error message:
119: print_error("The command 'system_profiler' does not exist on the host! Something is seriously wrong!")
120: return
121: end
122: command_result = cmd_exec('system_profiler SPApplicationsDataType').to_s
123: if command_result.empty?
124: print_error('No results were returned when trying to get software installed on the OSX host via system_profiler!')
125: return
126: end
127: listing += command_result
128:
129: # Start enumerating other potential MacOS package managers now that
Something is odd with this Android device. You are root but the dumpsys command doesn't exist. Perhaps the device is too old?
Here is a relevant code snippet related to the "Something is odd with this Android device. You are root but the dumpsys command doesn't exist. Perhaps the device is too old?" error message:
141: file = store_loot('host.osx.software.versions', 'text/plain', session, listing, 'installed_software.txt', 'Installed Software and Versions')
142: print_good("Stored information about the installed products to the loot file at #{file}")
143: when 'android'
144: if is_root?
145: if command_exists?('dumpsys') == false
146: print_error("Something is odd with this Android device. You are root but the dumpsys command doesn't exist. Perhaps the device is too old?")
147: return
148: end
149: listing = cmd_exec('dumpsys package packages').to_s
150: if listing.empty?
151: print_error('Something went wrong with the command and no output was returned!')
Something went wrong with the command and no output was returned!
Here is a relevant code snippet related to the "Something went wrong with the command and no output was returned!" error message:
146: print_error("Something is odd with this Android device. You are root but the dumpsys command doesn't exist. Perhaps the device is too old?")
147: return
148: end
149: listing = cmd_exec('dumpsys package packages').to_s
150: if listing.empty?
151: print_error('Something went wrong with the command and no output was returned!')
152: return
153: elsif listing =~ /android.permission.DUMP/
154: print_warning('You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed.')
155: listing = enumerate_android_packages
156: return if listing.nil?
You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed.
Here is a relevant code snippet related to the "You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed." error message:
149: listing = cmd_exec('dumpsys package packages').to_s
150: if listing.empty?
151: print_error('Something went wrong with the command and no output was returned!')
152: return
153: elsif listing =~ /android.permission.DUMP/
154: print_warning('You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed.')
155: listing = enumerate_android_packages
156: return if listing.nil?
157: end
158: else
159: print_warning('You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed.')
You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed.
Here is a relevant code snippet related to the "You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed." error message:
154: print_warning('You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed.')
155: listing = enumerate_android_packages
156: return if listing.nil?
157: end
158: else
159: print_warning('You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed.')
160: listing = enumerate_android_packages
161: return if listing.nil?
162: end
163: file = store_loot('host.android.software.versions', 'text/plain', session, listing, 'installed_software.txt', 'Installed Software and Versions')
164: print_good("Stored information about the installed products to the loot file at #{file}")
Go back to menu.
Related Pull Requests
- #14734 Merged Pull Request: Rubocop recently landed modules
- #14140 Merged Pull Request: Add a module to enumerate all the installed software and their given versions
Go back to menu.
See Also
Check also the following modules related to this module:
- post/multi/gather/apple_ios_backup
- post/multi/gather/aws_ec2_instance_metadata
- post/multi/gather/aws_keys
- post/multi/gather/check_malware
- post/multi/gather/chrome_cookies
- post/multi/gather/dbvis_enum
- post/multi/gather/dns_bruteforce
- post/multi/gather/dns_reverse_lookup
- post/multi/gather/dns_srv_lookup
- post/multi/gather/docker_creds
- post/multi/gather/enum_hexchat
- post/multi/gather/enum_vbox
- post/multi/gather/env
- post/multi/gather/fetchmailrc_creds
- post/multi/gather/filezilla_client_cred
- post/multi/gather/find_vmx
- post/multi/gather/firefox_creds
- post/multi/gather/gpg_creds
- post/multi/gather/grub_creds
- post/multi/gather/irssi_creds
- post/multi/gather/jboss_gather
- post/multi/gather/jenkins_gather
- post/multi/gather/lastpass_creds
- post/multi/gather/maven_creds
- post/multi/gather/multi_command
- post/multi/gather/netrc_creds
- post/multi/gather/pgpass_creds
- post/multi/gather/pidgin_cred
- post/multi/gather/ping_sweep
- post/multi/gather/remmina_creds
- post/multi/gather/resolve_hosts
- post/multi/gather/rsyncd_creds
- post/multi/gather/rubygems_api_key
- post/multi/gather/run_console_rc_file
- post/multi/gather/saltstack_salt
- post/multi/gather/skype_enum
- post/multi/gather/ssh_creds
- post/multi/gather/thunderbird_creds
- post/multi/gather/tomcat_gather
- post/multi/gather/ubiquiti_unifi_backup
- post/multi/gather/unix_cached_ad_hashes
- post/multi/gather/unix_kerberos_tickets
- post/multi/gather/wlan_geolocate
Authors
- gwillcox-r7
Version
This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.
Go back to menu.