Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8

9
  def initialize(info = {})
10
    super(update_info(info,
11
      'Name'           => 'Apple TV Image Remote Control',
12
      'Description'    => %q(
13
        This module will show an image on an AppleTV device for a period of time.
14
        Some AppleTV devices are actually password-protected, in that case please
15
        set the PASSWORD datastore option. For password brute forcing, please see
16
        the module auxiliary/scanner/http/appletv_login.
17
      ),
18
      'Author'         =>
19
        [
20
          '0a29406d9794e4f9b30b3c5d6702c708', # Original work
21
          'sinn3r'                            # You can blame me for mistakes
22
        ],
23
      'References'     =>
24
        [
25
          ['URL', 'http://nto.github.io/AirPlay.html']
26
        ],
27
      'DefaultOptions' => { 'HttpUsername' => 'AirPlay' },
28
      'License'        => MSF_LICENSE
29
    ))
30

31
    # Make the PASSWORD option more visible and hope the user is more aware of this option
32
    register_options([
33
      Opt::RPORT(7000),
34
      OptInt.new('TIME', [true, 'Time in seconds to show the image', 10]),
35
      OptPath.new('FILE', [true, 'Image to upload and show']),
36
      OptString.new('HttpPassword', [false, 'The password for AppleTV AirPlay'])
37
    ])
38

39
    # We're not actually using any of these against AppleTV in our Rex HTTP client init,
40
    # so deregister them so we don't overwhelm the user with fake options.
41
    deregister_options(
42
      'HTTP::uri_encode_mode', 'HTTP::uri_full_url', 'HTTP::pad_method_uri_count',
43
      'HTTP::pad_uri_version_count', 'HTTP::pad_method_uri_type', 'HTTP::pad_uri_version_type',
44
      'HTTP::method_random_valid', 'HTTP::method_random_invalid', 'HTTP::method_random_case',
45
      'HTTP::uri_dir_self_reference', 'HTTP::uri_dir_fake_relative', 'HTTP::uri_use_backslashes',
46
      'HTTP::pad_fake_headers', 'HTTP::pad_fake_headers_count', 'HTTP::pad_get_params',
47
      'HTTP::pad_get_params_count', 'HTTP::pad_post_params', 'HTTP::pad_post_params_count',
48
      'HTTP::uri_fake_end', 'HTTP::uri_fake_params_start', 'HTTP::header_folding',
49
      'NTLM::UseNTLM2_session', 'NTLM::UseNTLMv2', 'NTLM::SendLM', 'NTLM::SendNTLM',
50
      'NTLM::SendSPN', 'NTLM::UseLMKey', 'DOMAIN', 'DigestAuthIIS', 'VHOST'
51
    )
52
  end
53

54

55
  #
56
  # Sends an image request to AppleTV. HttpClient isn't used because we actually need to keep
57
  # the connection alive so that the video can keep playing.
58
  #
59
  def send_image_request(opts)
60
    http = nil
61

62
    http = Rex::Proto::Http::Client.new(
63
      rhost,
64
      rport.to_i,
65
      {
66
        'Msf' => framework,
67
        'MsfExploit' => self
68
      },
69
      ssl,
70
      ssl_version,
71
      proxies,
72
      datastore['HttpUsername'],
73
      datastore['HttpPassword']
74
    )
75
    add_socket(http)
76

77
    http.set_config('agent' => datastore['UserAgent'])
78

79
    req = http.request_raw(opts)
80
    res = http.send_recv(req)
81

82
    Rex.sleep(datastore['TIME']) if res.code == 200
83
    http.close
84

85
    res
86
  end
87

88

89
  def get_image_data
90
    File.open(datastore['FILE'], 'rb') { |f| f.read(f.stat.size) }
91
  end
92

93

94
  def show_image
95
    image = get_image_data
96

97
    opts = {
98
      'method'  => 'PUT',
99
      'uri'     => '/photo',
100
      'data'    => image
101
    }
102

103
    res = send_image_request(opts)
104

105
    if !res
106
      print_status("The connection timed out")
107
    elsif res.code == 200
108
      print_status("Received HTTP 200")
109
    else
110
      print_error("The request failed due to an unknown reason")
111
    end
112
  end
113

114

115
  def run
116
    print_status("Image request sent. Duration set: #{datastore['TIME']} seconds")
117
    show_image
118
  end
119
end
120

121