1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Hardware::RFTransceiver::RFTransceiver
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'RF Transceiver Transmitter',
14
        'Description' => %q{
15
          This module powers an HWBridge-connected radio transceiver,
16
          effectively transmitting on the frequency set by the FREQ option.
17

18
          NOTE: Users of this module should be aware of their local laws,
19
          regulations, and licensing requirements for transmitting on any
20
          given radio frequency.
21
        },
22
        'References' => [
23
          ['URL', 'https://github.com/AndrewMohawk/RfCatHelpers']
24
        ],
25
        'License' => MSF_LICENSE,
26
        'Author' => ['Craig Smith'],
27
        'Platform' => ['hardware'],
28
        'SessionTypes' => ['hwbridge'],
29
        'Notes' => {
30
          'Stability' => [CRASH_SAFE],
31
          'SideEffects' => [PHYSICAL_EFFECTS],
32
          'Reliability' => []
33
        }
34
      )
35
    )
36
    register_options([
37
      OptInt.new('FREQ', [true, 'Frequency to transmit on']),
38
      OptInt.new('SECONDS', [false, 'Seconds to transmit', 4]),
39
      OptInt.new('BAUD', [false, 'Baud rate to use', 4800]),
40
      OptInt.new('POWER', [false, 'Power level', 100]),
41
      OptInt.new('INDEX', [false, 'USB Index to use', 0])
42
    ])
43
  end
44

45
  def run
46
    fail_with(Failure::BadConfig, 'Not an RF Transceiver') unless is_rf?
47

48
    unless set_index(datastore['INDEX'])
49
      print_error("Couldn't set USB index to #{datastore['INDEX']}")
50
      return
51
    end
52

53
    set_modulation('ASK/OOK')
54
    set_freq(datastore['FREQ'])
55
    set_sync_mode(0)
56
    set_baud(datastore['BAUD'])
57
    set_channel_spc(24000)
58
    set_mode('idle')
59
    set_power(datastore['POWER'])
60

61
    print_status("Transmitting on #{datastore['FREQ']} for #{datastore['SECONDS']} seconds...")
62
    set_mode('tx')
63
    sleep(datastore['SECONDS'])
64
    print_status('Finished transmitting')
65
    set_mode('idle')
66
  end
67
end
68

69