Working with Nessus Plugins
By default, Nessus will enable a number of plugins behind-the-scenes,
when running a default template.
While this is certainly useful in many scenarios,
we can also fine-tune our options to quickly run a single plugin.
We can use this feature to validate a previous finding or to quickly discover
all the targets in an environment that are at risk to a specific vulnerability.
For this example, we will set a plugin filter to identify if the DESKTOP machine
s vulnerable to CVE-2021-3156.
This is a locally exploitable vulnerability that allows an unprivileged
user to elevate privileges to root.
To leverage the dynamic plugin filter, we will once again begin with a New Scan.
This time, we will use the Advanced Dynamic Scan template.
This template allows us to use a dynamic plugin filter
instead of manually enabling or disabling plugins.
Once again, we’ll configure the name and target.
Next, we’ll provide the same SSH and sudo credentials we used in the last example,
meaning we’ll also be conducting an authenticated scan.
Now we can select the plugins we want to use in our vulnerability scan.
As stated before, the Advanced Dynamic Scan allows us to use a filter instead of
enabling or disabling groups or individual plugins.
To do so, let’s click on the Dynamic Plugins tab.
In the left dropdown menu, we’ll select CVE to filter for a specific CVE.
In the middle dropdown menu, we can choose from different filter arguments
to specify the matching behavior.
On the right dropdown menu, we can specify a CVE number.
After entering it,
we can click on Preview Plugins.
This may take a few minutes to complete.
Once Preview Plugins is finished running,
we get a list of found plugin families that cover this particular CVE.
One very handy feature of the dynamic plugin filter
is the ability to combine multiple filters.
In this example, we know that the target is an Ubuntu Linux system
and we can therefore use a second filter to specify the related plugin family.
Let’s add a new filter by clicking on the plus button next to the first filter.
A new plugin filter appears.
To restrict the plugin family to specific checks for Ubuntu,
let’s select Plugin Family on the left dropdown
and Ubuntu Local Security Checks on the right dropdown.
We can then click on Preview Plugins again
to list the plugins determined by our filters.
After it completes, let’s click on the dropdown
and choose Ubuntu Local Security Checks.
Nessus displays information about the plugin,
including affected Ubuntu versions, a short description,
and patch number, as well as the Plugin ID.
We can get more information by clicking on the plugin.
We are now able to review detailed information of the specified plugin.
After closing this window, we can launch the vulnerability scan as we did before.
Once the scan is finished,
let’s review the results by clicking on the Vulnerabilities tab.
The output lists one finding with a HIGH severity,
which was found by the plugin we specified with our dynamic plugin filter.
We can review the detailed information of the finding,
confirming that the target is in fact vulnerable to the CVE we specified.
The plugin output also contains information stating that Nessus
only used the reported version number of the affected application
and that it did not try to confirm the vulnerability by exploiting it in any way.
In an assessment, we should verify these kinds of results
to check if it is indeed an exploitable vulnerability.