通过数据库查询MVM的扫描漏洞名称和对应的扫描脚本关系

数据库和扫描脚本是漏洞扫描较为核心的两个部分，在日常运维中，官方的扫描脚本难免存在漏报误报的情况，想要深入了解和学习扫描的原理和验证漏洞，读对应漏洞的扫描脚本源代码是必不可少的。

下面的SQL语句，实现通过数据库查询MVM的扫描漏洞名称和对应的扫描脚本关系。

/****** Script for SelectTopNRows command from SSMS  ******/
--ScriptVuln 表是FaultlineID和scriptID的对应关系表，但似乎是一一对应关系，所以略去。
SELECT [FaultlineID]
--,[faultline].[Content].[Vuln].[ModuleID]
--,[NID]
,[CVE]
,[MSFTID]
,[MSKBID]
,[CheckVersion]
--,[CustomID]
--,[Type]
,[Name]
,[Description]
,[Observation]
,[Risk]
,[Recommendation]
,[Simplicity]
,[Popularity]
,[Impact]
,[Intrusive]
,[SANS]
--,[IAVA]
--,[IAVARefNumber]
--,[IAVAArmyRefNumber]
,[CheckRequiresCredentials]
,[AddedDate]
,[faultline].[Content].[Vuln].[ModifiedDate]
--,[DeletedDate]
,[Status]
--,[Customized]
--,[Version]
--,[Patched]
--,[SupersededID]
,faultline.content.script.[ScriptName]
--,faultline.content.script.[ModuleID]
--,faultline.content.script.[ScriptRole]
--,faultline.content.script.[CreatedDate]
,faultline.content.script.[ModifiedDate]
--,faultline.content.script.[Script]
FROM [faultline].[Content].[Vuln]
left join faultline.content.script on faultline.content.script.scriptID=FaultlineID

如图是查询结果中的几个字段，关键是找到ScriptName，去读取源码。

FaultlineID	CVE	MSFTID	ScriptName	Name	Description	Observation
1	CVE-1999-1011	MS99-025	web-iis-rds-v2.fasl3	(MS99-025) Microsoft IIS RDS Command Execution	A command execution vulnerability in Microsoft IIS MDAC package allows remote attackers to gain administrative control of targeted systems.	Microsoft Internet Information Server (IIS) is an industry standard HTTP server. MDAC (Microsoft Data Access Components) is a package used to integrate web and database services. It includes a component named RDS (Remote Data Services). RDS allows remote access via the internet to database objects through IIS. Both are included in a default installation of the Windows NT 4.0 Option Pack, but can be excluded via a custom installation. RDS includes a component called the DataFactory object, which has a vulnerability that could allow any web user to (a) Obtain unauthorized access to unpublished files on the IIS server and (b) Use MDAC to tunnel ODBC requests through to a remote internal or external location, thereby obtaining access to non public servers or effectively masking the source of an attack on another network. If the Microsoft JET OLE DB Provider or Microsoft DataShape Provider are installed, a user could use the shell() VBA command on the server with System privileges. These two vulnerabilities combined can allow an attacker on the Internet to run arbitrary commands with System level privileges on the target host. Vulnerable Systems: Microsoft IIS 4.0 For more information see: Microsoft Security Bulletin MS99-025: http://www.microsoft.com/technet/security/bulletin/ms99-025.mspx
2	CVE-MAP-NOMATCH	NULL	unix-rpc-cmsd-v2.fasl3	RPC Calendar Service cmsd Available	The RPC cmsd program was determined to be registered with the target system's portmapper.	The RPC cmsd program was determined to be registered with the target system's portmapper. RPC services are commonly enabled by default on most UNIX operating systems. Additionally, RPC services are regularly found to be vulnerable to buffer overflow and format string attacks that lead to complete compromise of the target system. Exploitation of RPC services affects all major UNIX operating systems including Solaris, HP/UX, AIX, Irix, Linux, FreeBSD and more. For more information see: CVE-1999-0320 CVE-1999-0696
39	CVE-1999-0833, CVE-1999-0851	NULL	unix-bind-nxt-overflow-v2.fasl3	ISC BIND NXT Buffer Overflow	A buffer overflow vulnerability exists within BIND 8.2 NXT record processing that allows an attacker to execute arbitrary code on vulnerable systems.	The portion of code responsible for processing NXT records in BIND 8.2 and 8.2.1 is vulnerable to a buffer overflow attack. By sending specially crafted NXT record traffic to a vulnerable system it is possible to execute arbitrary code on the target system. Vulnerable Systems: ISC BIND 8.2 - 8.2.1 on UNIX For more information see: BID 788: http://online.securityfocus.com/bid/788

脚本的内容也是存储在数据库中的，而且是经过加密的，内容不能直接可读，要查看脚本内容也只能通过MVM自己的编辑器，直接用文本编辑器打开是不可读的。和Nmap、Openvas的开源脚本不同。不过能都已经是不错了。

另外，MVM的更新原理是也通过数据库实现，即更新包实际上是更新数据库的内容，其他组件再通过与数据库的通信实现各自的更新。数据库成了核心。

本文出自 “奋斗的菜鸟” 博客，谢绝转载！