1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'Amazon Fire TV YouTube Remote Control',
14
        'Description' => %q{
15
          This module acts as a simple remote control for the Amazon Fire TV's
16
          YouTube app.
17

18
          Tested on the Amazon Fire TV Stick.
19
        },
20
        'Author' => ['wvu'],
21
        'References' => [
22
          ['URL', 'http://http://web.archive.org/web/20210301101536/http://www.amazon.com/dp/B00CX5P8FC/?_encoding=UTF8'],
23
          ['URL', 'https://www.amazon.com/dp/B00GDQ0RMG/ref=fs_ftvs']
24
        ],
25
        'License' => MSF_LICENSE,
26
        'Actions' => [
27
          ['Play', { 'Description' => 'Play video' }],
28
          ['Stop', { 'Description' => 'Stop video' }]
29
        ],
30
        'DefaultAction' => 'Play',
31
        'Notes' => {
32
          'Stability' => [CRASH_SAFE],
33
          'SideEffects' => [IOC_IN_LOGS, SCREEN_EFFECTS],
34
          'Reliability' => []
35
        }
36
      )
37
    )
38

39
    register_options([
40
      Opt::RPORT(8008),
41
      OptString.new('VID', [true, 'Video ID', 'kxopViU98Xo'])
42
    ])
43
  end
44

45
  def run
46
    case action.name
47
    when 'Play'
48
      stop
49
      sleep(1)
50
      res = play
51
    when 'Stop'
52
      res = stop
53
    end
54

55
    return unless res
56

57
    case res.code
58
    when 201
59
      print_good("Playing https://www.youtube.com/watch?v=#{datastore['VID']}")
60
    when 200
61
      print_status('Stopping video')
62
    when 404
63
      print_error("Couldn't #{action.name.downcase} video")
64
    end
65
  end
66

67
  def play
68
    send_request_cgi(
69
      'method' => 'POST',
70
      'uri' => '/apps/YouTube',
71
      'ctype' => 'text/plain',
72
      'vars_post' => {
73
        'v' => datastore['VID']
74
      }
75
    )
76
  rescue Rex::ConnectionRefused, Rex::ConnectionTimeout,
77
         Rex::HostUnreachable => e
78
    fail_with(Failure::Unreachable, e)
79
  end
80

81
  def stop
82
    send_request_raw(
83
      'method' => 'DELETE',
84
      'uri' => '/apps/YouTube/run'
85
    )
86
  rescue Rex::ConnectionRefused, Rex::ConnectionTimeout,
87
         Rex::HostUnreachable => e
88
    fail_with(Failure::Unreachable, e)
89
  end
90
end
91

92