Metasploit使用PostgreSQL作为数据库

（1）启动postgresql

root@kali:~# service postgresql start

(2). 设置用户与数据库

root@kali:~# su postgrespostgres@kali:/root$ createuser msf4 -PEnter password for new role:Enter it again:postgres@kali:/root$ createdb --owner=msf4 msf4
postgres@kali:/root$ exit
exit
root@kali:~# 

（3）.测试数据库连接状态

root@kali:~# msfconsole### ###msf > db_connect msf4:password@localhost/msf4[*] Rebuilding the module cache in the background...msf > db_status[*] postgresql connected to msf4msf > search 2015-0531[!] Module database cache not built yet, using slow search #这里要稍等一下才会正常，可以考虑关闭应用重启一下msf > 

(4). 设置自动连接

自动连接可以通过配置文件 /usr/share/metasploit-framework/config/database.yml 完成，内容可以通过复制database.yml.example并修改内容来完成设置。

root@kali:/usr/share/metasploit-framework/config# cp database.yml.example database.ymlroot@kali:/usr/share/metasploit-framework/config# vi database.ymlroot@kali:/usr/share/metasploit-framework/config# cat database.yml# Please only use postgresql bound to a TCP port.# Only postgresql is supportable for metasploit-framework# these days. (No SQLite, no MySQL).## To set up a metasploit database, follow the directions hosted at:# http://r-7.co/MSF-DEV#set-up-postgresqldevelopment: &pgsqladapter: postgresqldatabase: msf3 #主要该红色的这三个值username: msf3password: passwordhost: localhostport: 5432pool: 5timeout: 5# You will often want to seperate your databases between dev# mode and prod mode. Absent a production db, though, defaulting# to dev is pretty sensible for many developer-users.production: &production<<: *pgsql# Warning: The database defined as "test" will be erased and# re-generated from your development database when you run "rake".# Do not set this db to the same as development or production.## Note also, sqlite3 is totally unsupported by Metasploit now.test:<<: *pgsqldatabase: metasploit_framework_testusername: metasploit_framework_testpassword: ___________________________

重新执行msfconsole即可直接链接数据库

root@kali:~# msfconsole### ###msf > db_status[*] postgresql connected to msf4msf > search CVE-2015-0311Matching Modules================Name Disclosure Date Rank Description---- --------------- ---- -----------exploit/multi/browser/adobe_flash_uncompress_zlib_uaf 2014-04-28 great Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Freemsf > 

             

-----使用-oX选项进行扫描，生成***.xml的文件保存在当前的根目录下

           nmap -Pn -sS -A -oX Subnet1 192.168.137.2

 -----文件生成后，使用db_import将文件导入数据库中，db_hosts显示主机的信息

            连接到数据库     db_connect 用户名：密码@localhost/数据库名

            导入扫描文件     db_import  /root/Subnet1