Exploit Ranking

Exploit Ranking

As of version 3.3.2, every exploit module has been assigned a rank based on its potential impact to the target system. Support for using the new rankings to search, categorize, and prioritize exploits was added in version 3.3.3.

The ranking is implemented by adding a Rank constant at the top of the class declaration in the module:

class Metasploit4 < Msf::Exploit
    Rank = LowRanking
    def initialize(info={})
        ...
    end
    ...
end

The ranking values are one of the following, in descending order of reliability:

• ExcellentRanking
• GreatRanking
• GoodRanking
• NormalRanking
• AverageRanking
• LowRanking
• ManualRanking

The ranking methodology:

• ExcellentRanking - The exploit will never crash the service. This is the case for SQL Injection, CMD execution, RFI, LFI, etc. No typical memory corruption exploits should be given this ranking unless there are extraordinary circumstances (WMF Escape()).
• GreatRanking - The exploit has a default target AND either auto-detects the appropriate target or uses an application-specific return address AFTER a version check.
• GoodRanking - The exploit has a default target and it is the "common case" for this type of software (English, Windows XP for a desktop app, 2003 for server, etc).
• NormalRanking - The exploit is otherwise reliable, but depends on a specific version and can't reliably auto-detect (or doesn't autodetect).
• AverageRanking - The exploit is generally unreliable or difficult to exploit.
• LowRanking - The exploit is nearly impossible to exploit (or under 50%) for common platforms.
• ManualRanking - The exploit is so unstable or difficult to exploit and is basically a DoS. This ranking is also used when the module has no use unless specifically configured by the user (e.g.: php_eval).

The ranking value can be pulled from the module class object with the following calls:

modcls = framework.exploits["windows/browser/ie_createobject"]
modcls.rank      # => 600
modcls.rank_to_s # => "excellent"

The ranking value can also be pulled from the module instance:

mod = framework.exploits["windows/browser/ie_createobject"].new
mod.rank      # => 600
mod.rank_to_s # => "excellent"