Slashdot Mirror
Wi-Fi Exploits Coming to Metasploit
bucksDrop writes "Eweek.com is reporting that the Metasploit Project will add 802.11 (Wi-Fi) exploits to a new version of its point-and-click attack tool. Metasploit 3 will integrate kernel-mode payloads to allow users to use existing user-mode payloads for both kernel and non-kernel exploits. Metasploit is collaborating with Jon 'Johnny Cache' Ellch and implementing it by wrapping the LORCON library."
No really, I appreciate all the work that goes into putting this together. I'm sure privately distributed cracking tools already have some of this functionality. Maybe this will get OS vendors to pay a little more attention to wireless security. Wireless is not likely to be widely exploited mechanism for a worm, but it is still something that needs more attention.
W=10.1
F=9.8
i=2673.7
What is Wi-Fi?
Do I wrap my laptop in tinfoil yet, or not?
= Grow a brain...
Why don't hardware vendors simply release the source to their drivers so problems like this can be squashed quickly? Of course, there is no guarantee that the white hats will find problems before the black hats do, but it exposes flaws more eyeballs.
...that I speak for a lot of people, based on the low response to this particular gem of posting, when i say:
*blinkblink*
WTF, mate?
Come read my stupid blagablog. Rants and Giggles
I've played around with metasploit in the past, especially their VNC payloads. The tool seems to have a high likelihood of abuse, compared to a lot of the other security tools (starting from nmap,nessus and all). Except for a couple of courtesy terminals, the tool basically gets you in and gives you a general feeling of being in control.
Canned scripts hardly ever teach you anything, especially when they work out of the box. Making them writing your own exploits is the easiest way to get a script kiddie to learn a bit and grow up (sort of).
Quidquid latine dictum sit, altum videtur
could a "broken-in" device (driver) be the new
challenged handshake?
in english: once broken into a bad (wifi) driver
the state the device is in is more secure since it
cannot be "double" hacked???
So will this make it even easier to get WEP Keys?
Modern usage
More recently, "begs the question" has been used as a synonym for "invites the question" or "raises the question", or to indicate that "the question really ought to be addressed". In this usage, "the question" is stated in the next phrase. For example: "This year's budget deficit is half a trillion dollars. This begs the question: how are we ever going to balance the budget?" This usage is often sharply criticized by proponents of the traditional meaning, but it has nonetheless come into common use as a result of its use in the media, especially by people ignorant of its original use. Argument over whether this usage should be considered incorrect is an example of the debate between linguistic prescription and description.
Personally I fall srongly on the description side. Perscrition is useful when you are a studentand learning language, but language is a construct for humans to communicate, and as such, description should be the primary motivation for a linguist. Language is how the majority use it, not how scholars define it.
Install the latest Lorcon snapshot:
:-)
$ http://www.802.11mercenary.net/lorcon/
Grab the latest version of metasploit 3:
$ svn co http://metasploit.com/svn/framework3/trunk/
Compile the Metasploit Lorcon wrapper:
$ cd trunk/external/msflorcon
$ make
Plug in a support network card (I use a WPN511 with the madwifi-old driver in Gentoo)
Load the Metasploit Console (as root, since it needs raw WiFi access)
# trunk/msfconsole
Play with some of the demo modules
This is an example of sending fake beacon requests to flood the Windows Wireless Network Browser:
msf > use auxiliary/dos/wireless/fakeap
msf auxiliary(fakeap) > show options
Module options:
CHANNEL 11 yes The default channel number
DRIVER madwifi yes The name of the wireless driver for lorcon
INTERFACE ath0 yes The name of the wireless interface
Type the "run" command, or use "set VARIABLE VALUE" to change these options.
msf auxiliary(fakeap) >run
Hopefully now that the code is out there, someone independent (not Ellch and not a Mac blogger) will test this exploit on an out-of-the-box MacBook, and see if the hole lives up to the hype.
0 1 - just my two bits
It is the only spelling and grammar combination that actually makes sense
so..
luse
thare
itz
I recently removed a nasty trojan (a member of the 'Wareout' family) from my laptop, with the aid of the free Sophos Anti-Rootkit and fantastic free technical support from the great folks at the spybot forums. My best guess was that I got the infection when I logged into a free wifi connection at a local cafe. I saw a brief message from my antivirus software that a trojan had been detected, but afterwards, it reported nothing. After reading the eweek article, I learned that my Intel Pro/Wireless driver had major security vulnerabilities. I just downloaded the update and hopefully will be malware-free for a little while. So much precious time development time was wasted because of this infection!
Building a better ribosome since 1997
Proof of concept exploits, are one thing, arguably useful. But helpfully integrating them into a tool script kiddies can use is just wrong. This is the kind of thing that makes computer security an ongoing nightmare.
For every expert, there is an equal and opposite expert. - Arthur C. Clarke