metasploit-framework/modules/auxiliary/gather/chromecast_wifi.rb

132 lines
2.4 KiB
Ruby
Raw Normal View History

2014-06-12 02:00:47 +00:00
##
# This module requires Metasploit: http://metasploit.com/download
2014-06-12 02:00:47 +00:00
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
2014-06-12 02:00:47 +00:00
2016-03-08 13:02:44 +00:00
class MetasploitModule < Msf::Auxiliary
2014-06-12 02:00:47 +00:00
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Chromecast Wifi Enumeration',
'Description' => %q{
2014-06-12 02:00:47 +00:00
This module enumerates wireless access points through Chromecast.
},
'Author' => ['wvu'],
'References' => [
['URL', 'http://www.google.com/intl/en/chrome/devices/chromecast/index.html'] # vendor website
2014-06-12 02:00:47 +00:00
],
'License' => MSF_LICENSE
2014-06-12 02:00:47 +00:00
))
register_options([
Opt::RPORT(8008)
], self.class)
end
def run
res = scan
2014-09-04 21:16:29 +00:00
return unless res && res.code == 200
2014-06-12 02:00:47 +00:00
waps = Rex::Text::Table.new(
'Header' => 'Wireless Access Points',
'Columns' => [
'BSSID',
'PWR',
'ENC',
'CIPHER',
'AUTH',
'ESSID'
],
'SortIndex' => -1
)
JSON.parse(res.body).each do |wap|
waps << [
wap['bssid'],
wap['signal_level'],
enc(wap),
cipher(wap),
auth(wap),
wap['ssid'] + (wap['wpa_id'] ? ' (*)' : '')
]
2014-06-12 02:00:47 +00:00
end
print_line(waps.to_s)
report_note(
:host => rhost,
:port => rport,
:proto => 'tcp',
:type => 'chromecast.wifi',
:data => waps.to_csv
)
2014-06-12 02:00:47 +00:00
end
def scan
begin
send_request_raw(
'method' => 'POST',
'uri' => '/setup/scan_wifi',
'agent' => Rex::Text.rand_text_english(rand(42) + 1)
2014-06-12 02:00:47 +00:00
)
send_request_raw(
'method' => 'GET',
'uri' => '/setup/scan_results',
'agent' => Rex::Text.rand_text_english(rand(42) + 1)
2014-06-12 02:00:47 +00:00
)
rescue Rex::ConnectionRefused, Rex::ConnectionTimeout,
Rex::HostUnreachable => e
fail_with(Failure::Unreachable, e)
ensure
disconnect
end
end
2014-06-22 04:15:20 +00:00
def enc(wap)
case wap['wpa_auth']
when 1
'OPN'
when 2
'WEP'
when 5
'WPA'
when 0, 7
'WPA2'
else
wap['wpa_auth']
end
end
def cipher(wap)
case wap['wpa_cipher']
when 1
''
when 2
'WEP'
when 3
'TKIP'
when 4
'CCMP'
else
wap['wpa_cipher']
end
end
def auth(wap)
case wap['wpa_auth']
when 0
'MGT'
when 5, 7
'PSK'
else
''
end
end
2014-06-12 02:00:47 +00:00
end