metasploit-framework/lib/msf/core/exploit/dialup.rb

module Msf

module Exploit::Remote::Dialup

	def initialize(info = {})
		super

		register_options(
			[
				OptInt.new(   'BAUDRATE',     [true, 'Baud Rate', 19200]),
				OptEnum.new(  'DATABITS',     [true, 'Data Bits (4 is Windows Only)', '8', ['4', '5', '6', '7', '8'], '8']),
				OptString.new('DIALPREFIX',   [true, 'Dial Prefix', 'ATDT *67, *70,']),
				OptString.new('DIALSUFFIX',   [false, 'Dial Suffix', nil]),
				OptInt.new(   'DIALTIMEOUT',  [true, 'Dial Timeout in seconds', 60]),
				OptBool.new(  'DISPLAYMODEM', [true, 'Displays modem commands and responses on the console', false]),
				OptEnum.new(  'FLOWCONTROL',  [true, 'Flow Control', 'None', ['None', 'Hardware', 'Software', 'Both'], 'None']),
				OptString.new('INITSTRING',   [true, 'Initialization String', 'AT X6 S11=80']),
				OptString.new('NUMBER',       [true, 'Number to Dial (e.g. 1.800.950.9955, (202) 358-1234, 358.1234 etc.)', nil]),
				OptEnum.new(  'PARITY',       [true, 'Parity (Mark & Space are Windows Only)', 'None', ['None', 'Even', 'Odd', 'Mark', 'Space'], 'None']),
				OptString.new('SERIALPORT',   [true, 'Serial Port (e.g. 0 (COM1), 1 (COM2), /dev/ttyS0, etc.)', '/dev/ttyS0']),
				OptEnum.new(  'STOPBITS',     [true, 'Stop Bits', '1', ['1', '2'], '1']),
			], self.class)

		deregister_options('RHOST')

		begin
			require 'telephony'
			@telephony_loaded = true
		rescue ::Exception => e
			@telephony_loaded = false
			@telephony_error  = e
		end
	end

	# Opens the modem connection
	def connect_dialup(global = true, opts={})

		if (not @telephony_loaded)
			print_status("The serialport module is not available: #{telephony_error}")
			raise RuntimeError, "Telephony not available"
		end

		serialport = datastore['SERIALPORT']
		baud       = datastore['BAUDRATE'].to_i
		data_bits  = datastore['DATABITS'].to_i
		stop_bits  = datastore['STOPBITS'].to_i
		parity     = case datastore['PARITY']
			when 'Even' ; Telephony::Modem::EVEN
			when 'Odd'  ; Telephony::Modem::ODD
			when 'Mark' ; Telephony::Modem::MARK
			when 'Space'; Telephony::Modem::SPACE
			else          Telephony::Modem::NONE
		end
		flowcontrol  = case datastore['FLOWCONTROL']
			when 'Hardware' ; Telephony::Modem::HARD
			when 'Software' ; Telephony::Modem::SOFT
			when 'Both'     ; Telephony::Modem::HARD | Telephony::Modem::SOFT
			else              Telephony::Modem::NONE
		end

		initstring   = datastore['INITSTRING']
		dialprefix   = datastore['DIALPREFIX']
		dialsuffix   = datastore['DIALSUFFIX']
		dialtimeout  = datastore['DIALTIMEOUT'].to_i
		number       = datastore['NUMBER'].tr(' ', '')

		modem = Telephony::Modem.new(serialport)
		modem.params = {
			'baud'      => baud,
			'data_bits' => data_bits,
			'parity'    => parity,
			'stop_bits' => stop_bits
		}
		modem.flow_control = flowcontrol
		modem.display = datastore['DISPLAYMODEM']

		print_status("Initializing Modem")
		result = modem.put_command('ATZ', 3)
		if result != 'OK'
			print_error("Error resetting modem")
			return
		end
		result = modem.put_command(initstring, 3)
		if result != 'OK'
			print_error("Error initializing modem")
			return
		end

		print_status("Dialing: #{number} (#{dialtimeout} sec. timeout)")
		dialstring = dialprefix + ' ' + number
		dialstring += (' ' + dialsuffix) if dialsuffix

		time = Time.now
		result = modem.put_command(dialstring, dialtimeout)
		while result =~ /RINGING/i
			result = modem.get_response(dialtimeout-(Time.now-time))
		end

		case result
			when /CONNECT/i
				print_status("Carrier: #{result}" )
				self.modem = modem if global
				return modem
			else
				print_error("No Carrier")
				disconnect_dialup(modem)
				return nil
		end
	end

	# Closes the modem connection
	def disconnect_dialup(nmodem = self.modem)
		if(nmodem)
			nmodem.flush
			nmodem.hangup
			nmodem.close
		end
	end

	# Reads until timeout looking for regexp
	def dialup_expect(regexp, timeout)
		res = {
			:match  => false,
			:buffer => nil,
		}
		return res if ! self.modem

		res[:buffer] = ''

		time = Time.now
		while Time.now < time + timeout
			c = self.modem.getc
			res[:buffer] += c.chr if c
			if res[:buffer].match(regexp) != nil
				res[:match] = true
				while c
					c = self.modem.getc
					res[:buffer] += c.chr if c
				end
				return res
			end
		end
		return res
	end

	def dialup_getc
		return false if ! self.modem
		return self.modem.getc
	end

	def dialup_gets
		return false if ! self.modem
		buffer = ''
		c = self.modem.getc
		while c != 0x0a
			buffer += c
			c = self.modem.getc
		end
		buffer += c
		return buffer
	end

	def dialup_putc(c)
		return false if ! self.modem
		return self.modem.putc(c)
	end

	def dialup_puts(string)
		return false if ! self.modem
		return self.modem.puts(string)
	end

	def handler(nmodem = self.modem)
		# If the handler claims the modem, then we don't want it to get closed
		# during cleanup
		if ((rv = super) == Handler::Claimed)
			if (nmodem == self.modem)
				self.modem = nil
			end
		end

		return rv
	end

	attr_accessor :modem

end
end