While stringing together NSE scripts and Metasploit exploits can be easily done, the number of vulnerabilities that can be tested by NSE scripts is significantly less than the number of vulnerabilities that can be evaluated by dedicated vulnerability scanners such as Nessus. Fortunately, Nessus has a command-line utility called Nessuscmd that can also be easily accessed within bash. This recipe will demonstrate how to combine a targeted Nessus vulnerability scan with automatic MSF exploitation to validate the finding.
To use the script demonstrated in this recipe, you will need to have access to a system that is running a vulnerable service that can be identified using Nessus and can be exploited with Metasploit. In the example provided, the vsFTPd 2.3.4 backdoor vulnerability is used on the Metasploitable2 server. For more information on setting up Metasploitable2, please refer to the Installing Metasploitable2 recipe in...