Wi-Fi Exploits Coming to Metasploit

bucksDrop writes "Eweek.com is reporting that the Metasploit Project will add 802.11 (Wi-Fi) exploits to a new version of its point-and-click attack tool. Metasploit 3 will integrate kernel-mode payloads to allow users to use existing user-mode payloads for both kernel and non-kernel exploits. Metasploit is collaborating with Jon 'Johnny Cache' Ellch and implementing it by wrapping the LORCON library."

Comments

Thanks Guys

[99BottlesOfBeerInMyF]

No really, I appreciate all the work that goes into putting this together. I'm sure privately distributed cracking tools already have some of this functionality. Maybe this will get OS vendors to pay a little more attention to wireless security. Wireless is not likely to be widely exploited mechanism for a worm, but it is still something that needs more attention.

Math problem

[Anonymous Coward]

W=10.1
F=9.8
i=2673.7

What is Wi-Fi?

Re:Math problem

[dr.badass]

i=2673.7

With Metasploit you can make i = 4456.66

Re:Math problem

[Anonymous Coward]

For those too lazy to work it out...

Wi-Fi = i(W-F) = 3673.7 ( 0.3) = 802.11

Re:Math problem

[Grym]

My God! That'd be like 9/11 times 4.8921! We can't allow this to happen!

-Grym

Re:This begs the question...

[99BottlesOfBeerInMyF]

Why don't hardware vendors simply release the source to their drivers so problems like this can be squashed quickly?

Some of them probably will, but a lot of hardware vendors are reflexively secretive. Others, use the drivers to work around bugs in their products or are embarrassed of the shoddy quality of their code. I'd love the believe that the industry will start to demand open source drivers, but realistically, it is more likely that the OS developer community will have to account for untrusted hardware drivers by seriously re-architecting the way the kernel interacts with drivers.

So where is the code? Right here.

[spinja]

Install the latest Lorcon snapshot:
$ http://www.802.11mercenary.net/lorcon/

Grab the latest version of metasploit 3:
$ svn co http://metasploit.com/svn/framework3/trunk/

Compile the Metasploit Lorcon wrapper:
$ cd trunk/external/msflorcon
$ make

Plug in a support network card (I use a WPN511 with the madwifi-old driver in Gentoo)

Load the Metasploit Console (as root, since it needs raw WiFi access)
# trunk/msfconsole

Play with some of the demo modules :-)

This is an example of sending fake beacon requests to flood the Windows Wireless Network Browser:
msf > use auxiliary/dos/wireless/fakeap
msf auxiliary(fakeap) > show options

Module options:

      CHANNEL 11 yes The default channel number
      DRIVER madwifi yes The name of the wireless driver for lorcon
      INTERFACE ath0 yes The name of the wireless interface

Type the "run" command, or use "set VARIABLE VALUE" to change these options.

msf auxiliary(fakeap) >run

Re:So where is the code? Right here.

[towsonu2003]

sounds to me like it needs a GUI ;)

Re:You must be a perscriber

[Dhalka226]

Language is how the majority use it, not how scholars define it.

So I guess "loose" and "lose" are now synonymous..

I just really don't agree. I'm not the kind who generally goes off on people for misusing words as long as I can understand what they're trying to say, but at the same time, words have meanings. The fact that people have no idea how to properly use those words should not change what the words mean. It should just make us exceptionally sad at the state of affairs our communications skills are in.

Incidentally, this is coming from somebody who misused the phrase "begs the question" dozens of times in his life. The difference being, when it was pointed out to me (I forget if somebody said something or I just came across the correct usage one day), I actually made a mental note of it and I have used it properly since then. It wasn't hard. Neither, as my little joke intimated, is using "lose" and "loose" properly. It just takes a little conscious effort at first, and then it will become second nature.

Personally I think we should be getting people to do that rather than pandering to them and altering the meaning of words and phrases once we reach some ignorance threshold.

Re:You must be a perscriber

[foamrotreturns]

I am very much in agreement. If the masses are allowed to dictate whatever meaning they choose for words or phrases they hear, they will slowly erode the vast variety of meanings that can be conveyed through speech and writing. If I said "That begs the question" 75 years ago, most people would realize that I was calling out the speaker for using a circular argument. Saying "That begs the question" today evokes responses like "What question?" The meaning is nearly lost. We have hundreds of thousands of simple words and phrases that we use to convey much more complex concepts. If we let our language become eroded by the uneducated masses, how will we become educated? We will waste all of our time explaining our ideas in excruciating detail rather than using the previously ubiquitous simplified words and phrases that were crafted to symbolize those very concepts.
Don't use words and phrases for which you haven't learned the meanings!