diff --git a/modules/vulnerabilities/windows/wifi_mouse_windows/files/create-firewall-rule.ps1 b/modules/vulnerabilities/windows/wifi_mouse_windows/files/create-firewall-rule.ps1 new file mode 100644 index 000000000..2cc987f68 --- /dev/null +++ b/modules/vulnerabilities/windows/wifi_mouse_windows/files/create-firewall-rule.ps1 @@ -0,0 +1,2 @@ +netsh advfirewall firewall add rule name=MouseServer dir=in action=allow program="C:\\Program\ Files\ (x86)\\MouseServer.exe\\MouseServer.exe" enable=yes +schtasks /create /rl HIGHEST /ru system /sc ONSTART /tn wifimousefirewall /f /tr "netsh advfirewall firewall add rule name=MouseServer dir=in action=allow program=C:\\Program\ Files\ (x86)\\MouseServer.exe\\MouseServer.exe enable=yes" \ No newline at end of file diff --git a/modules/vulnerabilities/windows/wifi_mouse_windows/files/vc_redist.x86.exe b/modules/vulnerabilities/windows/wifi_mouse_windows/files/vc_redist.x86.exe new file mode 100644 index 000000000..caea04acb Binary files /dev/null and b/modules/vulnerabilities/windows/wifi_mouse_windows/files/vc_redist.x86.exe differ diff --git a/modules/vulnerabilities/windows/wifi_mouse_windows/files/wireless_mouse_installer.exe b/modules/vulnerabilities/windows/wifi_mouse_windows/files/wireless_mouse_installer.exe new file mode 100644 index 000000000..45f8ba0e1 Binary files /dev/null and b/modules/vulnerabilities/windows/wifi_mouse_windows/files/wireless_mouse_installer.exe differ diff --git a/modules/vulnerabilities/windows/wifi_mouse_windows/manifests/flags.pp b/modules/vulnerabilities/windows/wifi_mouse_windows/manifests/flags.pp new file mode 100644 index 000000000..6764696bf --- /dev/null +++ b/modules/vulnerabilities/windows/wifi_mouse_windows/manifests/flags.pp @@ -0,0 +1,13 @@ +class wifi_mouse_windows::flags { + # this is how secgen +## $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file) + $leaked_filenames = ["flagsecret"] ##$secgen_parameters['leaked_filenames'] + $strings_to_leak = ["flag message"] ##$secgen_parameters['strings_to_leak'] + + ::secgen_functions::leak_files { 'wireless-mouse-file-leak': + storage_directory => "C:\\", + leaked_filenames => $leaked_filenames, + strings_to_leak => $strings_to_leak, + leaked_from => 'wireless_mouse', + } +} diff --git a/modules/vulnerabilities/windows/wifi_mouse_windows/manifests/install.pp b/modules/vulnerabilities/windows/wifi_mouse_windows/manifests/install.pp new file mode 100644 index 000000000..89276fefb --- /dev/null +++ b/modules/vulnerabilities/windows/wifi_mouse_windows/manifests/install.pp @@ -0,0 +1,23 @@ +class wifi_mouse_windows::install { + Exec { path => ["C:\\Windows"] } + + file { 'C:\vc_redist.x86.exe': + source => 'puppet:///modules/wifi_mouse_windows/vc_redist.x86.exe', + } -> + exec { 'install_c++_redistributable': + command => 'C:\\vc_redist.x86.exe /install /quiet /norestart', + } -> + file { 'C:\wireless_mouse_installer.exe': + source => 'puppet:///modules/wifi_mouse_windows/wireless_mouse_installer.exe', + } -> + exec { 'install_wireless_mouse': + command => 'C:\\Windows\\system32\\cmd.exe /c "start timeout /t 120 taskkill /b C:\\wireless_mouse_installer.exe /VERYSILENT /NORESTART"', + timeout => 1200, + } -> + file { 'C:\\create-firewall-rule.ps1': + source => 'puppet:///modules/wifi_mouse_windows/create-firewall-rule.ps1' + } -> + exec { 'create-firewall-rule': + command => 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -noexit -file "C:\\create-firewall-rule.ps1"', + } +} diff --git a/modules/vulnerabilities/windows/wifi_mouse_windows/secgen_metadata.xml b/modules/vulnerabilities/windows/wifi_mouse_windows/secgen_metadata.xml new file mode 100644 index 000000000..b732e07d6 --- /dev/null +++ b/modules/vulnerabilities/windows/wifi_mouse_windows/secgen_metadata.xml @@ -0,0 +1,30 @@ + + + WiFi Mouse Windows + Harry J. Hall + MIT + + The Windows version of WiFi Mouse 1.7.8.5 which contains an authentication vulnerability. + WiFi Mouse is a tool for controlling a computer using a smartphone. + + + Remote control software + user_rwx + remote + windows + medium + + server_name + strings_to_leak + leaked_filenames + + + + + + + + + \ No newline at end of file diff --git a/modules/vulnerabilities/windows/wifi_mouse_windows/wifi_mouse_windows.pp b/modules/vulnerabilities/windows/wifi_mouse_windows/wifi_mouse_windows.pp new file mode 100644 index 000000000..510b47d81 --- /dev/null +++ b/modules/vulnerabilities/windows/wifi_mouse_windows/wifi_mouse_windows.pp @@ -0,0 +1,2 @@ +include wifi_mouse_windows::install +include wifi_mouse_windows::flags